As you point out, in most use cases a random token will be fine and it all comes down to how and where it is stored. But that also means that you can have JWTs

As you point out, in most use cases a random token will be fine and it all comes down to how and where it is stored. But that also means that you can have JWTs that are used as "random token" for most of your app, cost to produce them isn't high, and only make use of the additional capacities for instance when - when you want to check signatures (e.g. reject before hitting your application layer) - store non sensitive base64 data that you want before restoring the session Creating and handling JWT is only as costly and complicated as you want it to be, so there's IMHO enough flexibility to have light use with very few penalities for it.