JWT is a compact, URL-safe means of representing claims to be transferred between two parties. It's a self-contained token that carries information about the user and can be verified without storing session information on the server.

A JWT consists of three parts separated by dots:

• Header: Contains the token type (JWT) and signing algorithm
• Payload: Contains claims (statements about an entity and additional data)
• Signature: Used to verify the sender and ensure the message wasn't changed

Structure: xxxxx.yyyyy.zzzzz

How it works:

1. User authenticates with credentials
2. Server creates a JWT containing user information
3. JWT is sent to the client
4. Client includes JWT in subsequent requests
5. Server validates the JWT signature and extracts user information

Header:

{
  "alg": "HS256",
  "typ": "JWT"
}

Contains metadata about the token, including the signing algorithm and token type.

Payload:

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022,
  "exp": 1516242622
}

Contains claims - statements about an entity (typically the user) and additional data. Claims can be registered, public, or private.

Signature:

HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secret
)

Used to verify that the sender of the JWT is who it says it is and to ensure that the message wasn't changed along the way.