If a token has the familiar three-part form header.payload.signature, its header and claims are usually readable by anyone who has the token. They are base64url-encoded, not encrypted. The signature can help detect tampering and verify a trusted issuer; it does not hide the contents. JWTs can also use encryption, so the precise answer depends on the token’s format.
What the three parts of a signed JWT contain
The common compact signed form is a JSON Web Signature (JWS): three strings separated by periods. The first two are encoded representations; the third is a cryptographic signature or message authentication code (MAC). OWASP explains that a JWS payload is base64url-encoded, not encrypted, so anyone who obtains the token can read its claims (OWASP JSON Web Token Cheat Sheet).
As an Amazon Associate I earn from qualifying purchases.
1. Protected header
The first component decodes to a JOSE header, commonly JSON. It can identify the signing algorithm and token type. Header values are visible too; they are not secret merely because they are part of a token.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →2. Claims payload
The second component decodes to a JSON claims set: statements about a subject or other data. Common registered claim names include iss (issuer), sub (subject), aud (audience), and exp (expiration time). Applications can add their own claims. A payload might therefore reveal account identifiers, permissions, or other data, depending on what the issuer chose to include.
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Base64url is an encoding that can be reversed, not a confidentiality mechanism. Decoding a JWS does not require the signing key.
3. Signature or MAC
The final component protects the header and payload representation against undetected changes when the token is correctly validated. With a digital signature, an issuer signs using a private key and a verifier checks using the corresponding public key. With a MAC, parties sharing the secret can both create and validate tokens. Neither approach encrypts the JWS claims. RFC 7515 defines the JWS format and its integrity-protection role (RFC 7515).
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- This BookFactory log book is for security guards in any sector or business. You can report location, circumstances and report number.
- There are spaces to log the individual's names address, description and other identifying information. There are also spaces to note others involved, notes, and vehicle information if one was involved
- Wire-O, 100 Pages, Dimensions 3.5" x 5.25"
- Reorder SKU: LOG-100-M3CW-PP(Security-Report)
How a JWT can be encrypted
JWT describes a claims representation; it does not guarantee one particular security property. Claims may be carried in a JWS, or in a JSON Web Encryption (JWE) object for confidentiality. A compact JWE has five components rather than three:
- Protected header
- Encrypted key
- Initialization vector
- Ciphertext
- Authentication tag
In a JWE, the claims are carried as ciphertext and are not directly readable without successful decryption. The header can still expose selected information, so encryption does not necessarily conceal every detail about the token. See RFC 7516 for the JWE structure.
Rank #3
JWTs can also be nested: one JWT can be signed and then encrypted, or otherwise combined in a defined construction. That gives the recipient encryption-based confidentiality as well as the properties of the inner signed object, subject to correct implementation and validation. The JWT specification describes both encrypted and nested JWTs (RFC 7519).
Readable does not mean safe to alter—or safe to share
A valid signature is not a secrecy guarantee. It gives a verifier a way to detect changes and, with appropriate key handling and checks, establish that the token meets a trust policy. An attacker who can read a signed payload may still be unable to produce a valid replacement, but anyone who obtains a usable bearer token may be able to present it as a credential. Treat the token itself as sensitive, whether or not its claims are encrypted.
Transport encryption such as TLS protects data in transit between endpoints, but it does not make a signed JWT’s payload confidential to systems that can access the token. Tokens can also be exposed through application logs, browser storage, referrer headers, or systems that terminate TLS. RFC 7519 warns that a JWT may contain privacy-sensitive information and calls for measures to prevent disclosure to unintended parties.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Do not put passwords, private keys, or other secrets in a readable JWS payload.
- Minimize personal or operational details in claims; include only what the receiving service needs.
- Protect bearer tokens as credentials and avoid copying live production tokens into public or third-party tools.
- Keep sensitive state server-side and send an opaque reference when the client or intermediary does not need the underlying data.
- Use JWE when claims must travel confidentially to an intended recipient, with keys and algorithms configured for the application’s security profile.
Decoding a token is not verifying it
A decoder can show the header and payload, but parsing those fields does not prove who issued the token or whether an API should accept it. OWASP’s testing guidance distinguishes decoding from verification (OWASP Testing JSON Web Tokens).
Best Value
Before trusting claims, a relying application should verify the cryptographic protection using the expected key and a restricted, expected algorithm set. It should also validate the claims relevant to its context, including issuer, audience, expiration, token type, and any required application-specific claims. A token can be well-formed and readable yet invalid for the service receiving it.
How to inspect a JWT without leaking one
For learning, jwt.io’s debugger can display decoded headers and payloads and offers optional signature verification (jwt.io JWT Debugger). Use a fabricated example or a trusted local tool instead of pasting a live production token into a third-party page. A displayed payload is not evidence of a valid signature unless verification is performed with the right key and rules.
As a quick visual clue, a three-component compact token is commonly a JWS and its payload is readable after base64url decoding. A five-component compact token is commonly a JWE, whose ciphertext requires decryption. Do not rely on appearance alone to accept a token: parsing, cryptographic verification or decryption, and claim validation are separate steps.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
