A bearer token grants access to whoever possesses it. This is why bearer tokens must be protected in transit and at rest.

JWT is a token format consisting of encoded header, payload, and signature. A JWT may contain claims such as issuer, subject, audience, expiration, and issued-at time.

A signature provides integrity and authenticity of the signed token; it does not automatically provide confidentiality. Sensitive data should not be placed into a JWT merely because it is encoded.

Servers must validate the algorithm, signature, issuer, audience, expiration, and other required claims according to the application's security model.