The definition for JSON Web Tokens (JWT, see RFC 7519) says that it is a "URL-safe means of representing claims to be transferred between two parties".
I’m wondering, what does it mean if something is URL-safe?
As far as I know, JWT are not passed around as part of the URL. Is it just that, or is there more to it?
>Solution :
Later in the RFC it says:
A JWT is represented as a sequence of URL-safe parts separated by
period (‘.’) characters. Each part contains a base64url-encoded
value.
This, combined with the RFC not specifying some other meaning explicitly, suggests it means simply "safe to put in a URL" (e.g., doesn’t have unencoded / or ? or & characters, etc.).