All questions
Q & A Developer · September 11, 2026

Is a JWT encrypted or just signed?

Standard JWTs (JWS — JSON Web Signature) are signed, not encrypted. The header and payload are base64url-encoded, which is not encryption — anyone can decode them and read the claims. That’s why you should never put secrets in a JWT payload. If you need the payload confidential, use JWE (JSON Web Encryption), a different format that encrypts the payload. In practice, ~99% of JWTs in the wild are JWS. If you’re wondering whether yours are: paste one into the JWT decoder. If you see readable JSON, it’s signed-not-encrypted (JWS).

Read the full guide
What Is a JWT?
JWT (JSON Web Token) is the dominant format for API authentication, OAuth access tokens, and stateless session management. Three base64-encoded segments carry the header, claims, and signature — anyone can read them, but only the key holder can produce a valid token.
Related questions
Are UUIDs guaranteed to be unique? Can I revoke a JWT before it expires? Can I use UUID as a primary key? How do I verify a JWT signature without the secret? How much larger does Base64 make my payload?