JWT
In plain terms
A compact, signed token that carries identity and claims between systems.
Going deeper
A JSON Web Token packs user data and permissions into a signed string the server can verify without a database lookup. It's common for stateless authentication across APIs.
Under the hood
Self-contained and stateless, but can't be easily revoked before expiry; keep them short-lived, store carefully (XSS/CSRF risks), and never put secrets in the payload.
Examples
Bearer tokens in Authorization headers, access/refresh token pairs, OIDC id_tokens.
Think of it like...
Like a tamper-proof wristband at a festival: it states who you are and which areas you can enter, and staff trust it because the seal can't be faked.