What is JWT and how is it validated in REST APIs?

A JWT (JSON Web Token) consists of three Base64URL-encoded parts separated by dots: header.payload.signature. The header specifies the algorithm (e.g., HS256, RS256). The payload contains claims: standard ones (sub for subject/user ID, exp for expiry, iat for issued-at) and custom ones (role, permissions). The signature is computed with a secret (HS256) or private key (RS256), allowing verification without a database lookup. Validation steps: verify the signature, check exp has not passed, check iss (issuer) and aud (audience) if set. JWTs are stateless — revocation requires short expiry times plus a refresh token mechanism or a token blacklist. Never store sensitive data in the payload — it is only encoded, not encrypted.