Sessions vs JWTs
Two ways an app remembers your login: a record kept on the server, or a signed token your browser holds.
Once you log in, the app has to know it's you on every request. There are two classic ways: sessions, and tokens.
What they are
With a session, the server keeps a record of your login, and your browser holds just an ID in a cookie. With a token, often a JWT, the server hands you a signed pass instead.
How they work
A JWT has three parts: a header, a payload with details like your user ID and an expiry time, and a signature. The server checks the signature on every request, so any change is caught. But the payload is only encoded, not encrypted, so never put secrets inside.
Why it matters
Sessions are easy to cancel: delete the record, and you're logged out. Tokens are easy to scale, but hard to revoke early, so keep them short-lived.
