How would you secure sensitive data claims so a decoded JWT doesn't leak PII if intercepted?

Avoid placing PII (emails, names, SSNs) in JWT claims at all where possible — reference a user ID instead, and let the resource server fetch full profile detail server-side when actually needed. Where identity claims genuinely must travel in the token (as with OIDC ID tokens), consider using JWE (JSON Web Encryption) to encrypt sensitive claims, not just sign them, and always enforce token transport exclusively over TLS.