What distinguishes a standard authentication token from a JSON Web Token (JWT)?

A standard authentication token is usually a random string generated and stored on the server side (for example, in a database or in memory). The client sends this token with each request, and the server verifies its validity by matching it with the stored data. This approach requires stateful storage on the server.

JSON Web Token (JWT) is a self-contained token that contains encoded information (payload), such as user data and expiration time. JWT is signed with a secret key or a pair of keys, allowing the server to verify the authenticity of the token without needing to store its state. JWT typically consists of three parts: header, payload, and signature, separated by dots.

Main differences:

• State storage: a standard token requires storage on the server, JWT does not (stateless).
• Content: JWT contains a payload with information, a standard token is just an identifier.
• Verification: JWT is verified by its signature, a standard token by its presence in the database.

Example of JWT:

{
  "alg": "HS256",
  "typ": "JWT"
}
.
{
  "sub": "1234567890",
  "name": "Ivan Ivanov",
  "iat": 1516239022
}
.
<signature>