Documentation / Platform glossary / JSON Web Token
A JSON Web Token is a compact, URL-safe format for transmitting signed claims between parties. It has three parts — header, payload, signature — and its defining property is that a recipient can verify the token's integrity and origin without calling back to the issuer.
A JWT is three base64url-encoded segments joined by dots. The header names the signing algorithm and key. The payload carries claims: registered ones such as issuer, subject, audience, and expiry, plus any application-specific claims. The signature covers the first two segments.
The critical point is that base64url is encoding, not encryption. A JWT's payload is readable by anyone holding the token. The signature guarantees it has not been altered; it does nothing to keep it private. Sensitive data does not belong in a JWT payload.
Verification means checking several things together: that the signature is valid against the expected key, that iss is the expected issuer, that aud names this application, and that exp has not passed. Skipping any of these is a common vulnerability class — the best-known being acceptance of a token declaring alg: none, where a verifier that trusts the header's algorithm choice accepts unsigned tokens.
Because verification is self-contained, revocation is the hard part. A signed token remains valid until it expires, which is why access tokens are short-lived and paired with refresh tokens rather than issued with long lifetimes.
Self-contained verification is what makes JWTs suited to distributed systems: a service can authorize a request without a round trip to a central session store. That property is also the trade-off, since it makes immediate revocation impossible by design.
The practical consequence is that token lifetime is a security decision. Long-lived tokens buy convenience and pay for it with an unbounded revocation window.
QueryTek uses signed tokens in standards-based identity flows, keeps lifetimes short, and treats token contents as non-secret. Public documentation describes the model; claim structure, signing keys, and lifetimes are not published.
