After you log in, many apps hand your browser a JWT. Each later request includes it, and the server checks the signature to confirm the token is genuine and unchanged, then trusts the claims inside, such as a user id and an expiry time.
The common misunderstanding is that a JWT hides its contents. Standard signed JWTs are only encoded, so anyone who gets one can decode and read the payload. Never put secrets or private data in it. The other failure is weak checking on the server: accepting a token whose algorithm is set to none, skipping the expiry check, or not confirming the issuer and audience.
Use a maintained library, verify the signature and the expiry on every request, keep lifetimes short, and send the token in a header rather than in a URL. Supabase Auth issues JWTs, and your Row Level Security policies read the user id from them.