The encyclopedia · Software & IT · Technical decision · 2015–2026
JWT moved identity into a signed token so servers store no session
A compact, signed JSON object carries the claims, so a server trusts the signature and never does a session lookup.
Internet Engineering Task Force · Auth0
the move
A stateless API still must know who is calling, but a session store forces every server to consult the same database or cache, which breaks when services scale out or sit behind a load balancer.
JWT solved this by encoding the claims into a compact, signed JSON token. Registered claims like issuer, subject and expiry are standard; private claims are free-form, so a caller can carry roles, IDs and permissions.
The verifier only checks the signature. If it validates, the claims are trusted as-is, so authentication across services becomes a cryptographic check rather than a network round-trip.
why it works
- The claims travel inside the token, so no lookup is needed to learn who the caller is.
- The signature binds claims to a key, so a token cannot be forged or quietly edited.
- Because it is just an HTTP header, the same token works across microservices and browsers.
what transfers
If every service must trust the same user, put the truth in a signed token each of them can verify, instead of a shared session store that becomes the bottleneck and single point of failure.
what came after
JWT became the default bearer format for OAuth 2.0 and OpenID Connect, and is used by nearly every API framework. Statelessness brought a trade-off: a token is valid until it expires, so revocation needs short lifetimes or a blocklist, a problem the ecosystem addressed with token rotation and jti revocation lists.
references
spotted an error? The archive wants to know.