When coding authentication, two options stand out for managing a user's login state. Making the choice between these can often times be hard, especially as choosing the right one for the right situation is vital for crafting a secure system.

At the core, a JSON Web Token (JWT) is a standalone string of characters that contains a 3 part JSON object when decoded. These three parts are the header (containing metadata like expiration time), body (any data you want to encode in the token), and the signature. The most important part of this is the signature, as that is what's used to verify that any data in the JWT is the same as when it was created, meaning if an attacker obtains a JWT they can't just change the body's userId property to be logged in as a different user. Instead the signature portion would catch this change and make the entire token invalid.

The main difference between a JWT vs a Session based approach is that the JWT is often considered stateless. Meaning the server doesn't need to store any data about the login made by the user, ever. The only time this can come into play is when security is increased by allowing users to "blacklist" certain token's if they ever become compromised.

The lines begin to blur when your system needs more security, like tracking where a user logs in at, or being able to revoke all sessions for a user.