A web token is a session credential that lets an online service recognize a user without asking for the password again. It may represent an active login session, an API grant, or a refreshable access credential stored in a browser, app, or authentication system.
Web tokens matter because stealing one can bypass password protection entirely. In credential theft, attackers look for token caches, browser session data, or application-specific token files and then replay the token to access mail, chat, cloud, gaming, or SaaS accounts. This can enable account takeover even if the original password is changed. Defenders treat token theft as an incident response issue: revoke sessions, invalidate refresh tokens or API keys where possible, and review unusual logins, process activity, and access from new devices. Strong endpoint controls and short session lifetimes reduce the value of a stolen token.