JWT Explained: What It Is, What It Is Not, and How to Use It Right

JWT (JSON Web Token) is simply a signed JSON object used to pass claims between parties — it is not a session store, a database, or a built-in authentication system. The token carries fields like subject and expiration, and its signature ensures it has not been tampered with, but it cannot be revoked before it expires without additional infrastructure. A common pattern for single-page applications uses short-lived access tokens (15 minutes) alongside long-lived refresh tokens stored in secure httpOnly cookies, reducing risk if a token is leaked. When early revocation is required — such as after a password change — developers must implement either a token blocklist in Redis or a database, or a version counter stored on the user record, both of which introduce server-side state. JWT works best for stateless APIs, microservices, and cross-domain authentication, but simpler session cookies may be more appropriate when only a single server consumes the tokens.