What is in a JWT token that allows it to be validated?

JWT (JSON Web Token) consists of three parts: header, payload, and signature. For token validation, the signature is important, which is created using a secret key or a private key (in the case of asymmetric cryptography).

The signature allows verifying that the token has not been altered after creation and that it was indeed issued by a trusted source. During validation, the server uses the secret or public key to confirm the correctness of the signature.

Thus, JWT has an embedded mechanism for integrity and authenticity verification through a digital signature, which allows validating the token without accessing a database.