A JSON Web Token (JWT) is a compact, URL-safe token format defined by RFC 7519 that lets two parties exchange claims securely. JWTs are widely used for authentication and authorization in web applications, allowing servers to verify a user's identity and permissions without hitting a database on every request. The token is self-contained, carrying all the necessary user information in its encoded payload.
A JWT has three Base64URL-encoded parts separated by dots: a header (specifying the signing algorithm, typically HMAC SHA-256 or RSA), a payload (containing claims such as user ID, roles, and expiration time), and a signature (which proves the token hasn't been tampered with). When a user authenticates, the server generates a signed JWT and sends it back to the client, which then includes the token in the Authorization header of subsequent API requests.
JWTs work well in distributed systems and microservices because any service with access to the signing key can validate the token on its own, removing the need for centralized session storage. That said, proper implementation requires attention to security: use strong signing algorithms, set reasonable expiration times, never store sensitive data in the payload (it's encoded but not encrypted), and have a strategy for token refresh and revocation. JWTs are the backbone of modern authentication standards including OAuth 2.0 and OpenID Connect.