JWT

JSON Web Token

A secure, compact way to transmit information between parties as a JSON object. Think of it as a digital passport that proves who you are and what you’re allowed to do. It comprises three parts separated by dots: a header, payload, and signature (e.g., xxxxx.yyyyy.zzzzz).

JWTs are primarily used for authentication and authorization in web applications. When you log into a website, the server can give you a JWT that proves your identity for future requests, instead of making you log in again. It’s like getting a wristband at a festival – once you have it, you can enter different areas without showing your ID again.

JWT Example

Here’s what a typical JWT workflow looks like:

1. You log into a website with your username and password
2. The server creates a JWT containing your user information:

{
  "userId": "123",
  "name": "John",
  "role": "admin",
  "expiresIn": "1 hour"
}

3. The server signs this information and sends you the JWT
4. For your next requests, you include this JWT (usually in the Authorization header)
5. The server verifies the JWT to know who you are and what you can access

JWTs are widely used in modern web applications, especially in single-page applications (SPAs) and microservices architectures, because they’re stateless and can work across different domains.