JWT is a scam and your app doesn't need it

The author argues that JWT (JSON Web Tokens) is an overused and poorly-suited authentication method that creates more problems than it solves. While JWT's value proposition is stateless authentication through signature verification alone, this breaks down in practice because tokens cannot be revoked before expiration—forcing developers to either accept the security risk of long-lived compromised tokens or maintain a revocation list that defeats the "stateless" purpose. The refresh token pattern commonly used to mitigate this adds significant complexity across multiple client platforms without delivering the promised benefits of JWT.