JWT

A JWT, or JSON Web Token, is a compact, URL-safe token made of three Base64url-encoded parts separated by dots: a header, a payload of claims, and a signature. The claims carry information such as who the user is and when the token expires, and the signature lets a server confirm the token was issued by a trusted party and has not been altered. Because the payload is only encoded, not encrypted, anyone can read a JWT’s contents — so it should never carry secrets. Crucially, decoding a JWT is not the same as verifying it: reading the claims proves nothing until the signature is checked, which must happen on the server.