JWT
acronymweb devsecuritycryptography
Stands for: JSON Web Token
A compact, signed token that carries claims about a user, used to prove identity between services.
A JSON Web Token packs data (who you are, what you can do, when it expires) into a signed string the receiver can verify without a database lookup. Convenient and stateless, but easy to misuse: it should be validated carefully and not treated as secret storage.
A JWT is three base64url segments separated by dots: a header naming the algorithm, a payload of claims, and a signature. The critical property, and the one most misunderstood, is that the payload is encoded rather than encrypted. Anyone holding the token can read every claim in it, so putting anything confidential in a JWT means publishing it.
The signature is what makes the token trustworthy, and validation is where implementations fail. The classic vulnerability is accepting the algorithm the token itself declares: a token arriving with the algorithm set to none, or switched from RSA to HMAC so the public key becomes the verifying secret, will pass a naive check. The rule that survives contact with attackers is that the server decides which algorithm is acceptable, never the token.
The operational trade is revocation. A signed token is valid until it expires because verification is local and requires no lookup, which is precisely what makes JWTs scale and precisely what makes an early logout hard. Short lifetimes with refresh tokens are the usual compromise, and any design that needs instant revocation is fighting the format rather than using it.
Also known as: jwt, json web token, jot, bearer token