JWT
A signed claim you can read (before verifying).
Where it came from
JSON Web Token (JWT, RFC 7519) emerged from the JOSE working group around 2014 as a compact, URL-safe way to carry claims between parties. It became the default auth token for SPAs and APIs overnight.
Its appeal: self-contained — a server signs a payload and the client just presents it. No session lookup needed. Its danger: a misconfigured "none" algorithm or weak secret leaks everything.
How it works
A JWT is three Base64url segments joined by dots: header.algorithm.payload.claims.signature. Only the signature is opaque; the header and payload are plain Base64url you can decode and read.
UWC decodes the header and payload client-side so you can inspect claims (sub, exp, iat) — it never verifies or forges signatures, keeping your secrets local.