The three parts of a JSON Web Token
A JSON Web Token, or JWT, is a compact string made of three base64url-encoded sections separated by dots: header, payload, and signature. The header declares the token type and the signing algorithm, such as HS256 or RS256. The payload carries the claims, which are statements about the user and the token, including registered claims like the subject, issuer, and expiration time.
The signature is computed over the encoded header and payload using a secret or a private key. Because the header and payload are only encoded, not encrypted, anyone can read them, so a JWT should never carry secrets in its payload.
How stateless authentication works
JWTs enable stateless authentication. After a user logs in, the server issues a signed token that the client sends back with each request. The server verifies the signature using its key, and if it matches and the token has not expired, it trusts the claims without storing any session on its side.
This avoids server-side session lookups and scales well across multiple servers. The tradeoff is revocation: because the token is self-contained, invalidating one before it expires requires extra mechanisms such as short lifetimes or a denylist.