What is a JWT?

A JWT has three base64url-encoded segments separated by dots: a header describing the signing algorithm, a payload of claims (subject, issuer, expiration, custom scopes), and a signature computed over the first two parts with a secret or private key. Because the signature is self-contained, a service can validate a JWT's authenticity and expiration locally in microseconds, which is why JWTs are the backbone of stateless authentication across microservices and API gateways. The tradeoff is that a JWT cannot be silently revoked before it expires — once issued, it is valid until its `exp` claim passes, so systems that need instant revocation pair JWTs with short lifetimes plus a refresh-token exchange, or a denylist for the rare emergency case. Signing algorithm choice matters too: `HS256` uses a shared secret while `RS256`/`ES256` use asymmetric keys, which lets a third party verify a token without ever holding the signing key.