JSON Web Token

JSON Web Token (JWT) is an open standard (RFC 7519) defining a compact, URL-safe method for securely transmitting claims between two parties via a digitally signed JSON object.

JWTs (pronounced 'jots') are the go-to for modern, stateless authorization and information exchange. The token uses a compact serialization format: `Header.Payload.Signature`, each part Base64URL-encoded. The Header specifies the token type and the signing algorithm (e.g., HMAC SHA256 or RSA). The Payload carries the 'claims' (data assertions) like `iss` (issuer), `exp` (expiration time), and custom user roles. Crucially, the Signature verifies the token's integrity: it’s calculated using the Header, the Payload, and a secret key. This structure allows a server to validate a user's identity and permissions—like an admin role—without a database lookup, simply by checking the cryptographic signature.

https://jwt.io