You've used JWTs a hundred times. But here's the thing: you've probably never actually sent one.

That token in your Authorization header? Technically, it's a JWS .

JOSE, JWS, JWE, JWA, JWK, JWT. It's alphabet soup. Here's one analogy that makes all of it click.

JOSE: the shipping company

Start with JOSE : JSON Object Signing and Encryption. It's not a token. It's a family of IETF standards.

Think of it as a shipping company, with rules for how packages get sealed , locked and delivered .

JWT: the letter

A JWT isn't a container at all. It's the letter inside: a set of claims.

{ "iss" : "auth.example.com" , "sub" : "user_42" , "aud" : "orders-api" , "exp" : 1767225600 }

Enter fullscreen mode

Exit fullscreen mode

Who issued it. Who it's about. Who it's for. And when it expires.

But a letter on its own isn't secure. It needs packaging.

JWS: the sealed envelope

Option one: JWS , JSON Web Signature.…