JWT are even smaller than their size since you can revoke them by hash (although you should really just revoke by user ID in most cases). Your tokens should ge

JWT are even smaller than their size since you can revoke them by hash (although you should really just revoke by user ID in most cases). Your tokens should generally have a rather short lifetime - then you can keep the entire relevant window of revocations in memory. The implementation is not trivial though, that's for sure.