JSON Web Token (JWT)

A JSON Web Token (JWT) is a compact, self-contained way to represent claims — facts about a user or client — as a signed string that can be passed between parties. It has three Base64-encoded parts separated by dots: a header, a payload of claims (like user ID, roles, and an expiry timestamp), and a signature. The signature is the key idea: because it's computed with a secret or private key, any server holding the matching key can verify the token is authentic and untampered without calling a database. That statelessness is why JWTs are everywhere in API auth and single sign-on — the token itself carries the identity. For SaaS builders, JWTs are what you'll typically receive after an OAuth login or issue for service-to-service calls. Two practical cautions: the payload is signed, not encrypted, so never put secrets in it — anyone can read the claims. And because you can't easily revoke a stateless token before it expires, keep lifetimes short and pair them with refresh tokens.