---
title: "Tokens \u0026 JWT"
canonical_url: https://www.janbrennenstuhl.eu/topics/tokens-jwt/
author: Jan Brennenstuhl
---

# Tokens & JWT

JSON Web Tokens and the JOSE family: what tokens are for, how they are signed, encrypted and verified, and where they go wrong.


JSON Web Tokens are everywhere and frequently misunderstood. Read the series in order: what JWTs are for, how they differ from OAuth, and the JOSE building blocks JWS, JWE, JWA and JWKS.


## Entries

- [What is inside a JWT?](https://www.janbrennenstuhl.eu/knowledge-base/oidc/jwt-anatomy/) (2026-10-13, guide): A signed JWT's claims are readable by anyone who holds it; trust comes only from verifying the signature with an allowed algorithm and a trusted key. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/oidc/jwt-anatomy/index.md
- [What is JWA? A Deep Dive into JSON Web Algorithms](https://www.janbrennenstuhl.eu/jwa/) (2023-06-08, essay): JWA defines the algorithms behind every JWT: HMAC suits setups with one issuer and verifier, while RSA and ECDSA let OpenID Connect clients verify tokens without central introspection. Markdown: https://www.janbrennenstuhl.eu/jwa/index.md
- [Mastering JWKS: JSON Web Key Sets Explained](https://www.janbrennenstuhl.eu/jwks/) (2023-06-02, essay): A JSON Web Key Set lets an identity provider publish its public keys at one URL, so clients can verify JWT signatures locally and the issuer can rotate keys without redistributing them. Markdown: https://www.janbrennenstuhl.eu/jwks/index.md
- [JSON Web Encryption: Exploring JWE Token](https://www.janbrennenstuhl.eu/jwe/) (2023-05-29, essay): JWE keeps a JWT's payload confidential through authenticated encryption, but its security depends on careful algorithm choice, key management, token expiry and keeping sensitive data out of headers. Markdown: https://www.janbrennenstuhl.eu/jwe/index.md
- [JWT vs OAuth 2.0: Understanding the Key Differences](https://www.janbrennenstuhl.eu/jwt-vs-oauth/) (2023-05-24, essay): OAuth 2.0 is an authorization framework for delegated access and JWT is a token format, so the two complement each other, and OpenID Connect combines them. Markdown: https://www.janbrennenstuhl.eu/jwt-vs-oauth/index.md
- [The Purpose of JWT: Stateless Authentication](https://www.janbrennenstuhl.eu/jwt-stateless-authentication/) (2017-04-28, essay): The purpose of JWT is stateless authentication: signed, self-contained tokens let services verify identity locally without a central session store, at the cost of hard revocation and token theft risk. Markdown: https://www.janbrennenstuhl.eu/jwt-stateless-authentication/index.md
- [Single-Use JWT: Unlocking the Power of Stateless One Time Token](https://www.janbrennenstuhl.eu/single-use-jwt/) (2016-12-30, essay): You can make a JWT single-use without a token store by signing it with server-side state that the operation changes, such as the current password hash in a password reset. Markdown: https://www.janbrennenstuhl.eu/single-use-jwt/index.md