How JWT Tokens Let Servers Authenticate Users Without Storing Sessions

HTTP is stateless, meaning servers have no memory of previous requests, so applications need a mechanism to recognise returning users. One traditional approach uses server-side sessions, but this creates complications when multiple servers share a load balancer. JSON Web Tokens (JWTs) solve this by issuing a signed token at login that the client sends with every subsequent request. A JWT consists of three base64url-encoded parts — header, payload, and signature — where the server verifies authenticity by checking the signature without any database lookup. Because the payload is encoded but not encrypted, sensitive data such as passwords should never be stored inside a JWT.