advancedJWT: Token-Based Authentication
Is a JWT payload encrypted? Can anyone read it?
No, by default a JWT payload is only Base64-encoded, not encrypted — anyone who obtains the token (e.g., by pasting it into jwt.io) can decode and read every claim without needing any secret. The secret/private key is only used to verify the SIGNATURE, not to hide the payload's content. Sensitive data should never be placed in JWT claims unless the token is additionally encrypted (JWE).
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response