Backend & systems·Security and identity
the token itself carries the claims and a signature, so you can verify it without a database lookup on every request.
JSON Web Token
Also calledJWT, bearer token
A signed, self-contained token carrying claims that any holder of the key can verify locally. That statelessness is the whole appeal and the whole problem: verification needs no round trip, and neither does revocation, which therefore does not exist. Keep expiry short, pair with refresh tokens, and never put anything in the payload you would mind the client reading.