A pass with readable details
A JWT can carry claims: details such as a user ID, who issued it, and when it expires. A signed JWT includes a signature the receiving system checks to detect changes.
Anyone with a signed JWT can usually read its details, so leave out sensitive information.
Check before trusting it
Systems check the signature, who issued the token, which service should accept it, and when it expires. They also decide what actions to allow. A stolen bearer token may work until expiry or revocation. JWTs do not provide a complete sign-in system.