A JWT Payload Is Not Secret
Decoding a sample token shows every claim; what never to put in one, and what to do instead.
By the TurantTools Dev team · Updated October 27, 2026 · 3 min read
A signed JWT is protected against changes, not against reading. The header and payload are just Base64URL-encoded JSON, so anyone holding the token can read every claim.
A token and what anyone can see in it
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMDQyIiwiZW1haWwiOiJhbmFAZXhhbXBsZS5jb20iLCJyb2xlIjoiYWRtaW4iLCJleHAiOjE4MzAwMDAwMDB9.c2lnbmF0dXJl
{
"sub": "1042",
"email": "[email protected]",
"role": "admin",
"exp": 1830000000
}What that means
- Never put passwords, API keys or personal data you wouldn't show the user in a JWT payload.
- Keep tokens short-lived (minutes, not weeks) and use refresh tokens for long sessions.
- If the contents must be secret, use JWE (encrypted tokens) or keep the data on the server and send an opaque ID.