JWTs vs Capability Tokens One of the primary advantages of JWTs is that they serve as capability tokens, allowing for a portable verification of capabilities/ privileges. However, JWTs are often criticized for a number of weaknesses.

What is the disadvantage of simply applying an HMAC to a JSON object yourself and avoiding the rest of the baggage of the JWT spec?
Disadvantage: You don't get the thrill of playing Russian roulette with a dumpster fire of an implementation ecosystem and underspecified protocol!

Disadvantage: You might accidentally reinvent JWT and repeat its errors anew if you're not careful.  (On the other hand, advantage: you might not.)