Is a JWT payload encrypted? Can anyone read it?

No, by default a JWT payload is only Base64-encoded, not encrypted — anyone who obtains the token (e.g., by pasting it into jwt.io) can decode and read every claim without needing any secret. The secret/private key is only used to verify the SIGNATURE, not to hide the payload's content. Sensitive data should never be placed in JWT claims unless the token is additionally encrypted (JWE).