JWTs Are Not Encrypted — A Common and Dangerous Misconception

The misconception, stated plainly

A standard JSON Web Token (JWT) is not encrypted. Its header and payload sections are simply Base64URL-encoded — a reversible text encoding, not a cipher — which means anyone who intercepts or copies a JWT can read its full contents instantly, with no secret key, no password, and no special tools beyond a text editor. This surprises a lot of developers who assume "signed" means "hidden," when it actually means something quite different.

What a JWT's signature actually protects

The signature at the end of a JWT proves the token wasn't tampered with after the issuing server created it, and (for tokens signed with a shared secret) that whoever created it knew that secret. It says nothing about who's allowed to read the token's contents — that's a completely separate concern that JWTs by themselves don't address at all.

The real-world mistake this leads to

A dangerously common mistake is putting sensitive information — a user's email, internal role, or worse, something like a password hash or personal ID number — directly into a JWT payload, assuming the signature keeps it private. It doesn't. If that JWT is ever logged, cached, stored in browser history, or intercepted on an unsecured connection, its full contents are exposed exactly as if it were plain text, because that's exactly what it is once decoded.

When you actually need encryption

If a token genuinely needs to keep its contents confidential from the person holding it (not just tamper-proof), the JWT specification does define an encrypted variant called JWE (JSON Web Encryption) — a different, less commonly used format from the standard signed JWT (JWS) that most authentication systems use. If your application handles anything sensitive in a token, it's worth explicitly checking which one you're actually using.

Decoding one safely

Because decoding a JWT requires no secret and no verification, it's perfectly safe to inspect one in a browser-only tool — there's no security barrier being bypassed, since the information was never hidden to begin with. Our JWT Decoder splits a token into its header and payload, pretty-prints both as readable JSON, and flags whether the token's exp claim shows it as expired, entirely client-side.