What is a JWT?
A JSON Web Token, a compact, signed piece of JSON used to convey claims (who the user is, what they can do) between systems.
A JWT is three base64-encoded segments joined by dots: a header (algorithm), a payload (the claims as JSON), and a signature. Anyone can read the payload (base64 is encoding, not encryption) but only a holder of the signing key can produce a valid signature, which is what lets the receiver trust the claims.
JWTs are popular for stateless auth. The server signs a token at login, the client sends it on every request, and the server verifies the signature without hitting a database. This makes horizontal scaling trivial; the cost is that revoking a JWT before it expires requires a denylist or a short token lifetime.
Common pitfalls: trusting the alg header (the "none" attack), using HS256 with a guessable secret, putting sensitive data in the payload (it's readable), and treating JWTs as opaque session tokens when a plain session cookie would have been simpler.