JSON Web Token (JWT)
A JSON Web Token is a compact, URL-safe way to encode a set of claims as a JSON object that is then cryptographically signed — allowing any party to verify the claims without contacting the issuer.
When to use this
JWTs are used throughout the OAuth and OpenID Connect ecosystem: as access tokens, as OpenID Connect ID tokens, and in Private Key JWT client authentication. Use JWTs when you want resource servers to validate tokens locally without a network call. Use opaque tokens + introspection when you need immediate revocability.
A JWT has three dot-separated parts: a base64url-encoded header specifying the algorithm, a base64url-encoded payload containing the claims, and a signature computed over both. Any recipient with the public key can verify the token hasn't been tampered with. JWTs are not encrypted by default — the payload is readable by anyone — so do not put sensitive data in a JWT unless it is also encrypted (JWE).
More resources
- JWT Profile for OAuth 2.0 Access Tokens RFC 9068
- Self-Encoded Access Tokens (oauth.com)
- jsonwebtoken.io — JWT debugger and encoder