tldr about jwt 1. They're made up of three .-delimited segments: header.data.sig 2. JWT doesn't prescribe any particular sig algorithm. The header indicates b

tldr about jwt 1. They're made up of three .-delimited segments: header.data.sig 2. JWT doesn't prescribe any particular sig algorithm. The header indicates by what method the {data} JSON object was signed to get {sig}. A common sig method is hmac-sha 3. JWT only provides a signature to assure that the {data} was not tampered with. The data is not private at all and easily inspected (which is nice for debugging). JWE can provide encryption http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption http://tools.ietf.org/html/draft-ietf-jose-json-web-encrypti... And for some: "Why is this useful?". It's useful if my API needs to receive requests to do serious business like delete things or post as your account. How do I know if the request is from a trusted source? Well if the trusted source has a secret key they can use to generate the {sig} according to the {data}, then I can verify that the requester had access to the secret key and therefore trusted.