Decode a JWT by hand and explain browser authentication

Explain how a browser stays signed in with JWTs: how the token is issued, stored and sent, and how the server checks it. Then decode a JWT string without a library: split it into header, payload and signature, base64url-decode the parts, parse the JSON, and say what verifying the signature would take. Only the titles of these reports were public.