JWT is a compact, URL-safe means of representing claims to be transferred between two parties. It's a self-contained token that carries information about the user and can be verified without storing session information on the server.
A JWT consists of three parts separated by dots:
Header: Contains the token type (JWT) and signing algorithm
Payload: Contains claims (statements about an entity and additional data)
Signature: Used to verify the sender and ensure the message wasn't changed
Structure: xxxxx.yyyyy.zzzzz
How it works:
User authenticates with credentials
Server creates a JWT containing user information
JWT is sent to the client
Client includes JWT in subsequent requests
Server validates the JWT signature and extracts user information
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
