> Secondly, why would the JWT continue to grow? I replied to your other comment more completely, but thought this part was worth answering as well. If you are

> Secondly, why would the JWT continue to grow? I replied to your other comment more completely, but thought this part was worth answering as well. If you are using JWTs for stateless authentication/authorization, you need to include the identity (which doesn't grow) AND the list of authorizations (which might grow). And, even if it doesn't grow, JWTs are quite large compared to the HMAC of a random token. HMAC size: 64 bytes, JWT size: several hundreds of bytes, easily a few kb, if we put more than the bare minimum.