JWT basics and common pitfalls

A JWT is a tamper evident slip of paper. Signed, not encrypted by default.

Definition

JSON Web Tokens are compact signed claims, encoded as three base64url segments separated by dots, used to assert identity or authorisation across services.

Step 1

Predict first

In one or two sentences, what do you think this concept means? Wrong is fine; the small struggle is what makes the answer stick.