Software Engineering · Security
A signed, self-contained token that encodes claims (user ID, roles, expiry) as base64 JSON — the server can verify it without hitting the database.
Example: An access token returned at login, attached to every subsequent request in an Authorization header.
In practice: JWTs can't be invalidated before they expire without extra infrastructure (a blocklist), which is why short expiry times plus refresh tokens are the standard pattern — a long-lived JWT is a loaded gun.
Debated: Often over-applied where a simple session cookie would work better — stateless verification is only worth the complexity if you actually need it, e.g. for microservices or cross-domain auth.