JWT stands for JSON Web Token. It packages a small JSON payload (like 'user 42, expires at 9pm') with a cryptographic signature, then Base64-encodes everything into a string like `xxx.yyy.zzz`.
The signature lets a server verify the token hasn't been tampered with, no database lookup needed. That's why JWTs are everywhere in stateless auth: APIs, OAuth, mobile apps.
Important: JWTs are signed, not encrypted. Anyone can read the payload. Never put secrets in a JWT.