Resta saysA JWT is a self-contained, signed token carrying claims the server can verify without a lookup.
A JSON Web Token encodes claims (user id, expiry, scopes) and is signed so the server can verify it wasn't tampered with — no database lookup needed to trust it. That makes JWTs stateless and scalable. The trade-off: you can't easily revoke one before it expires, so keep lifetimes short and pair with refresh tokens.
Power-ups you unlock
Self-contained, signed claims
Verifiable without a DB lookup
Stateless → scales well
Hard to revoke early → keep lifetimes short
The 401 Bandit attacks — common mistakes
Putting secrets in a JWT (payload is readable)
Long-lived JWTs you can’t revoke
Trusting an unsigned/"alg:none" token
Boss battleExplain the revocation trade-off of stateless JWTs.
Example code
<!doctype html><html><head><meta charset="utf-8"></head>
<body style="background:#06040d;color:#e6e0ff;font-family:monospace;padding:20px"><pre>JWT = header.payload.signature
server verifies signature → trusts claims
no DB hit, but can’t un-issue before expiry</pre></body></html>