JWT is not authentication and understanding this changes everything!

We often say things like "I use JWT for authentication." I've said it myself, because that’s how most of the industry talks. But technically, that's not what’s happening.

Authentication is the process of verifying who you are. JWT is just the token you receive after that process, a portable identity that services can validate.

Where the confusion starts

The issue is that many systems treat the token itself as if it were authentication, and that leads to common security pitfalls:

A token can remain valid even after a user loses access.

Revocation is difficult and often overlooked.

Once issued, a token can't simply be "taken back."

Teams sometimes store sensitive data inside the readable payload.

JWT frequently gets confused with session management.

JWT works beautifully for propagating identity and authorization across distributed systems, but it doesn't replace the authentication step.

Why this matters

When we understand these nuances, we make better technical decisions and build systems that are easier to maintain and much safer to scale.