Understanding JWT: How Servers Remember You Without Sessions

HTTP is stateless, so the server forgets you between every request. There are two ways around that: the server remembers you (sessions, with state in memory, a database, or Redis), or the request carries proof. A JSON Web Token is that proof.

A JWT is three base64url-encoded chunks joined by dots: header.payload.signature. Base64url is encoding, not encryption, so anyone holding the token can read the payload — never put secrets in it. The server verifies by recomputing the signature over the header and payload and comparing, which means no database lookup per request. HS256 uses one shared secret; RS256 signs with a private key and verifies with a public one, which suits a separate auth service issuing tokens for many verifiers.

The real weakness is revocation. A signed token stays valid until exp, so "log out everywhere" needs short expiry plus refresh tokens, or a denylist that reintroduces the server state you were avoiding.