The original title is: "What's Actually Inside a JWT (and Why Decoding One Isn't Verifying It)"

Short summary

A JWT is not encrypted — its header and payload are just Base64url-encoded JSON readable by anyone who holds the token. The security comes from the third segment: a keyed HMAC or digital signature that makes the token forgeable by no one, as long as your server verifies it. The critical trap is that decoding a JWT (reading the payload) is not the same as verifying it (checking the signature), and confusing the two leads to a well-known CVE class of authentication bypass.

• •JWT payloads are Base64url-encoded JSON, not encrypted — anyone can read them
• •Security relies on the signature segment; never put secrets in the payload
• •Decoding ≠ verifying: using decode() instead of verify() is a common and dangerous auth bypass bug

Generated with AI, which can make mistakes.