The original title is "Decoding JWT: It's Not Encryption, It's a Signature"

Short summary

JWT tokens are not encrypted — the header and payload are base64-encoded and readable by anyone. Trust comes from the signature, a hash of header plus payload created with a server-side secret key. The main trade-offs are that tokens cannot be instantly revoked and payloads expose their contents, so use short-lived access tokens with revocable refresh tokens and never store sensitive data in the payload.

• •JWT header and payload are base64-encoded, not encrypted
• •Signature verifies integrity using a server-side secret key
• •Use short-lived access tokens plus revocable refresh tokens; never put secrets in payload

Generated with AI, which can make mistakes.