Many applications use JWT (JWT) to allow the client to indicate its identity for further exchange after authentication. This information is signed by the server in order for it to detect whether it was tampered with after sending it to the client. This will prevent an attacker from changing the identity or any characteristics (for example, changing the role from simple user to admin or changing the client login). JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA.”]
Source: https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html