Week 18: JWT, Security, and Breaking My Own Auth System

JSON Web Tokens JWT Structure A JWT has three parts separated by dots: header, payload, and signature. The header holds the algorithm and token type. The payload holds the user data. The signature verifies that the token has not been tampered with. Nothing in the payload is encrypted. It is base64 encoded, which means anyone can decode it. Never put sensitive information like passwords or card numbers in a JWT. Signing and Verifying jwt.sign takes a payload, a secret, and options like expiry. It