What is JWT used for?

JWT (JSON Web Token) is used for secure transmission of information between parties in JSON format. Main applications:

Authorization: After successful authentication, the server issues a JWT to the client. The client sends this token with each request to protected resources. The server verifies the authenticity of the token and grants or denies access based on its content.
Information exchange: JWT can be used for exchanging information between services, where each party trusts the signed token.

The structure of JWT consists of three parts separated by dots:

Header: Contains the token type (JWT) and the signing algorithm used (e.g., HS256).
Payload: Contains claims — information about the entity (usually the user) and additional data. Standard claims include iss (issuer), exp (expiration time), sub (subject).
Signature: Created by encoding the header and payload in Base64 and signing them with a secret key using the algorithm specified in the header. The signature ensures the integrity of the token and confirms it was created by a trusted source.

Example Payload with claims:

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022,
  "exp": 1516242622
}