Difference between JWT and SAML?

Both SAML and JWT are security token formats that are not dependent on any programming language. SAML is the older format and is based on XML. It's used commonly in protocols like SAML-P, WS-Trust and WS-Federation (although not strictly required).

JWT (JSON Web Token) tokens are based on JSON and used in new authentication and authorization protocols like OpenID Connect and OAuth 2.0.

---

Both are used for Exchanging Authentication and Authorization data between parties, but in different format. SAML is a Markup Language(like XML) and JWT is a JSON.

Security Assertion Markup Language (SAML,pronounced SAM-el) is an open standard for exchanging authentication and authorization data between security domains, i.e. IdP (Identity Provider) and a SP (Service Provider).

An IdP (Identity Provider) : authenticates users and provides to Service Providers an Authentication Assertion if successful. Identity providers offer User Authentication As A Service.

A SP (Service Provider): relies on the Identity Provider to authenticate users.

Term in SAML Term in OAuth Description Client Client Example: A web browser Identity Provider(IdP) Authorization Server Server that owns the user identities and credentials Service Provider(SP) Resource Server The protected application

JSON Web Token (JWT, pronounced jot) is a ID Token based on JSON to pass user information as Header, Payload and Signature structure. https://jwt.io/

Note: Access Tokens (which aren't always JWTs) are used to inform an API that the bearer of the token has been authorized to access the API

Use case Standard to use Access to application from a portal SAML Centralized identity source SAML Enterprise SSO SAML Mobile use cases OAuth(preferably with Bearer Tokens) Permanent or temporary access to resources such as accounts, files OAuth

source

---

In addition, SAML is a protocol and a token format while JWT is only a token format.

---