JWTs (JSON Web Tokens).
A festival wristband: checked at a glance, with no call back to the box office.
- One check-in, please.1
You sign in once. In return you get a signed token — your wristband for the visit.
- 2
The token has three parts: who you are, some claims, and a signature.
- Wristband? In you go.3
Each later request just shows the token. The server trusts it on sight — no lookup.
- 4
The signature makes it tamper-evident: change one letter and it stops matching.
- 5
Anyone can read what is on it — so never put secrets in a token.
- Expires at midnight.6
It cannot easily be cancelled mid-visit, so tokens are kept short-lived.
Semicolony semicolony.dev/eli5/jwt/comic