JSON Web Tokens
tldr about jwt<p>1. They're made up of three .-delimited segments: header.data.sig<p>2. JWT doesn't prescribe any particular sig algorithm. The header indicates by what method the {data} JSON object was signed to get {sig}. A common sig method is hmac-sha<p>3. JWT only provides a signature to assure that the {data} was not tampered with. The data is not private at all and easily inspected (which is nice for debugging). JWE can provide encryption <a href="http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption" rel="nofollow">http://tools.ietf.org/html/draft-ietf-jose-json-web-encrypti...</a><p>And for some: "Why is this useful?". It's useful if my API needs to receive requests to do serious business like delete things or post as your account. How do I know if the request is from a trusted source? Well if the trusted source has a secret key they can use to generate the {sig} according to the {data}, then I can verify that the requester had access to the secret key and therefore trusted.