Glossary · Cryptography & authentication
JWT (JSON Web Token)
A JWT is a compact, signed token carrying claims (user ID, expiry, scopes) that services can verify statelessly — any holder of the verification key can check authenticity without a database lookup.
A JWT is three base64url segments: a header naming the algorithm, a claims payload, and a signature over both. Verification is local and fast, which is why JWTs dominate service-to-service auth and API sessions. The cost of statelessness is revocation: a signed token stays valid until expiry, so real systems pair short-lived access tokens with longer-lived, revocable refresh tokens.
The classic implementation mistakes are accepting the token’s own header as the source of truth (the alg=none and key-confusion attacks), putting secrets in the readable payload, and issuing long expiries. Ciphera services verify JWTs statelessly with 15-minute access tokens and 30-day rotating refresh tokens.