A JSON Web Token is a signed JSON payload. The server signs it once, hands it to the client, and can verify any future request without a database lookup — the signature proves the token wasn't tampered with. It's the backbone of most modern stateless auth.
1Header -> { "alg": "HS256", "typ": "JWT" }2Payload -> { "sub": "user_42", "role": "admin", "exp": 1735689600 }3Signature -> HMAC-SHA256(base64(header) + "." + base64(payload), secret)