JWTs carry claims (user ID, role, expiry) in a signed base64-encoded string. Client stores the token, sends it with each request, server verifies signature without a database lookup. Great for stateless APIs. Downsides: hard to revoke, big tokens hurt performance.
JWT
Also known as: JSON Web Token