What is JWT in the context of authorization? What are its three parts?

JWT (JSON Web Token) is a compact, URL-safe way to transmit information between parties as a JSON object, often used for authorization and authentication.

JWT consists of three parts, separated by dots:

1. Header — contains the token type (usually "JWT") and the signing algorithm (e.g., HS256).
2. Payload — contains claims, such as user ID, expiration time, and other information.
3. Signature — created by encoding the header and payload and signing them with a secret key or private key (depending on the algorithm).

Example JWT:

xxxxx.yyyyy.zzzzz

where xxxxx is the base64url-encoded header, yyyyy is the payload, and zzzzz is the signature.

JWT allows the server to verify that the token has not been altered and to use it for authorization without needing to store state on the server.