A secure, compact way to transmit information between parties as a JSON object. Think of it as a digital passport that proves who you are and what you’re allowed to do. It comprises three parts separated by dots: a header, payload, and signature (e.g., xxxxx.yyyyy.zzzzz).
JWTs are primarily used for authentication and authorization in web applications. When you log into a website, the server can give you a JWT that proves your identity for future requests, instead of making you log in again. It’s like getting a wristband at a festival – once you have it, you can enter different areas without showing your ID again.
JWT Example
Here’s what a typical JWT workflow looks like:
- You log into a website with your username and password
- The server creates a JWT containing your user information:
{
"userId": "123",
"name": "John",
"role": "admin",
"expiresIn": "1 hour"
}- The server signs this information and sends you the JWT
- For your next requests, you include this JWT (usually in the Authorization header)
- The server verifies the JWT to know who you are and what you can access
JWTs are widely used in modern web applications, especially in single-page applications (SPAs) and microservices architectures, because they’re stateless and can work across different domains.
Related Martech Zone Content
