How does token-based authentication with JWT work?

After login the server issues a signed JWT (header.payload.signature); the client stores it and sends it on every request as Authorization: Bearer <token>, and the server trusts it by re-checking the signature — no server-side session needed.

* A JWT is three Base64 parts — header.payload.signature — and the server trusts it by re-checking the signature. *

Flow:

1. Client sends login credentials (username, password)
2. Server validates and generates JWT from user data
3. Server sends JWT back to client
4. Client saves JWT in localStorage
5. Client includes JWT in Authorization header: Bearer ${JWT_TOKEN}
6. Server validates JWT and returns protected resources

JWT Structure (3 parts, Base64URL encoded, separated by dots):

• Header: Algorithm and token type ({"alg": "HS256", "typ": "JWT"})
• Payload: Claims/data ({"sub": "1234567890", "name": "John Doe", "admin": true})
• Signature: HMACSHA256(base64url(header) + "." + base64url(payload), secret)

Go deeper:

• RFC 7519 — JSON Web Token (JWT) — the JWT spec: header/payload/signature and registered claims.
• JSON Web Token (Wikipedia) — worked example of the three Base64URL parts and how the signature is checked.