A compact token format (RFC 7519) of three Base64url-encoded parts — header, claims payload and signature — separated by dots. The claims carry assertions such as who the subject is, who issued the token, its audience and its expiry, and the signature lets receivers verify integrity without contacting the issuer. Access and ID tokens issued by Entra ID and most OAuth 2.0/OIDC providers are JWTs.