How JWT authentication works
A JSON Web Token is a signed note that says who the user is. After login the server hands it to the client, the client sends it with every request, and the server checks the signature instead of looking up a session.
What is inside a token
A JWT has three parts: a header, a payload with claims such as the user id and expiry, and a signature made with a secret or private key. Anyone can read the payload; only the key holder can produce a valid signature, so the payload cannot be changed unnoticed.
Strengths and trade-offs
The server needs no session store, so APIs scale easily. The price is that a token is valid until it expires: you cannot easily cancel one. Use short lifetimes and a refresh token, and keep a deny list for emergencies.
Where to keep it
In a browser, an HttpOnly cookie protects the token from scripts that might be injected into the page. Storing it in local storage is simple but exposes it to any cross-site scripting bug.
Questions
Is a JWT encrypted?
Usually not, only signed. Do not put secrets in the payload.
How do I log a user out?
Delete the token on the client and keep its lifetime short. For forced logout, keep a list of revoked token ids until they expire.
JWT or sessions?
Sessions are simpler and easy to revoke. JWTs suit APIs used by many services or mobile apps, where a shared session store is awkward.
What is a refresh token?
A longer-lived credential used only to get new short-lived tokens, stored more carefully and revocable.