Glossary term
What is JWT (JSON Web Token)?
JWT stands for JSON Web Token.
In System Design
A signed token containing claims about a user. Example: header.payload.signature sent in Authorization: Bearer.
Learn it properly · System DesignLesson 49: Authentication vs Authorization: Sessions, Cookies & JWTEvery endpoint checked “is the user logged in?” — and changing one number in the URL showed another customer's invoice. Authentication vs authorization, storing passwords, MFA and passkeys, sessions vs JWTs (with a live token to tamper with), and RBAC, ABAC and ReBAC.In The Browser Contract
A signed token with three parts: header.payload.signature. Anyone who has it can read it. The signature shows that nobody changed it.
Learn it properly · The Browser ContractLesson 2: Sessions vs JWT: Stateful vs Stateless LoginWhat a signed JWT is, how it is different from a plain session ID, and where “stateless” stops helping: logging out, expiry, refresh tokens and the claims you must check.In API Design
A signed token with a header, a payload of claims and a signature; the payload is readable by anyone.
Learn it properly · API DesignLesson 6: API Authentication and Authorization: API Keys, OAuth 2.0 and ScopesAPI keys, bearer tokens, OAuth 2.0 flows in plain words, scopes, and common mistakes. Ties back to the Security series.