JWT

A JWT is a compact, signed token carrying claims about a user — who they are, what they may do, when the token expires. Because it is signed, a server can verify it without a database lookup, which is what makes it popular for APIs and for services that must not share a session store.

Two properties are routinely misunderstood. A JWT is signed, not encrypted: anyone holding it can read its contents, so it must never carry anything confidential. And it is valid until it expires — there is no natural way to revoke one, so a stolen token works until the clock runs out.

That second property drives the usual design: short-lived access tokens, a longer-lived refresh token that can be revoked, and expiry measured in minutes. A JWT valid for thirty days is a password with no way to change it.