JWTs carry a signature and a lifetime
Treat the payload as public, rely on the signature for authenticity, and always reject tokens whose exp is past to keep a replayed token from living too long. Encoded, not encrypted A JWT is not protected by secrecy; it is three base64url pieces, the header and claims in clear text plus the signature, joined by dots for compactness. Anyone holding the token can decode it and read every claim in plaintext. That is correct by design, and it has a sharp consequence for what you put inside: no secrets, no server credentials, no session material that belongs only to the server. If a value must be readable only by the server, do not embed it, look it up by a jti claim instead. Encoding is a transport step, not confidentiality. ...