What a JWT actually is

Three dots, three parts

The API hands out a token at /app/token. Grab one and split it on its dots:

curl -s http://127.0.0.1:8080/app/token | tr '.' '\n'

In the terminal

student@vulntech:~$ curl -s http://127.0.0.1:8080/app/token | tr '.' '\n'
eyJhbGciOiAiSFMyNTYiLCAidHlwIjogIkpXVCJ9
eyJ1c2VyIjogImd1ZXN0IiwgInJvbGUiOiAidXNlciJ9
owpzt-YKX2maMQ8G2DASNbYJkJWNvBbYkYxvHSHuNC8

Header, payload, signature. The first two are just base64url — readable by anyone, not encrypted. Decode the payload and you can see the claims the server will trust:

curl -s http://127.0.0.1:8080/app/token | cut -d. -f2 | python3 -c "import sys,base64;s=sys.stdin.read().strip();print(base64.urlsafe_b64decode(s+'='*(-len(s)%4)).decode())"

In the terminal

student@vulntech:~$ curl -s http://127.0.0.1:8080/app/token | cut -d. -f2 | python3 -c "import sys,base64;s=sys.stdin.read().strip();print(base64.urlsafe_b64decode(s+'='*(-len(s)%4)).decode())"
{"user": "guest", "role": "user"}

You are role: user. The signature is what's supposed to stop you changing that to admin — unless the server checks it wrong.