All questions
Q & A Security · September 11, 2026

Is a JWT encrypted or just signed?

Standard JWTs (JWS) are signed, not encrypted. The header and payload are base64url-encoded, which is not encryption — anyone can decode them and read the claims. If you need the payload confidential, you must use JWE (JSON Web Encryption), which encrypts the payload. In practice, most systems use JWS and treat the payload as public metadata.

Read the full guide
What Is a JWT? JSON Web Token Structure, Signing, and Security Explained
JWT (JSON Web Token) is the dominant format for API authentication, OAuth access tokens, and stateless session management. Three base64-encoded segments carry the header, claims, and signature — anyone can read them, but only the key holder can produce a valid token.
Related questions
Are UUIDs guaranteed to be unique? Can I revoke a JWT before it expires? Can I use UUID as a primary key? How do I verify a JWT signature without the secret? How much larger does Base64 make my payload?