JSON Web Token (JWT)
Definition
A JSON Web Token is a compact format for transmitting claims between parties.
JWTs are signed as JWS or MAC-protected, or encrypted as JWE. A commonly used signed JWT is not automatically encrypted; its payload can be readable.
Simply explained
Like a digital ID card with claims whose authenticity can be verified – but whose content is not necessarily secret.
Why it matters in practice
Relevant for authentication, authorization, and API sessions when tokens are properly validated and used short-lived.
Example from business
An API validates signature, issuer, audience, and expiry of an access token before executing a protected endpoint.
Limits and pitfalls
- Treat payload as secret; misconfigure alg/signature verification; make tokens valid too long; embed sensitive data unnecessarily.
Origin & history
JWT was standardized in 2015 as RFC 7519. RFC 8725 supplements best current practices for security issues.
Use in mid-sized companies
- Possible applications: standardized claims in OAuth-/OIDC-based web and API systems.
Frequently asked questions
Is JWT encrypted?
Not automatically. Is every JWT an Access Token? No. What must be validated? Among other things, the signature or protection mechanism and application-specific claims.
Sources
- RFC 7519 · RFC 7519
- JWT Best Current Practices · RFC 8725, JWT Best Current Practices
Sources checked on 10.10.2026.
Editorially reviewed on: