API Testing · Middle · Question 31 of 75
Why can a JWT be decoded by anyone who has it?
- 1Its payload is Base64url-encoded, not encrypted
- 2JWTs are always sent without any signature
- 3Every JWT contains the server's secret key
Show the answer
Correct answer: Its payload is Base64url-encoded, not encrypted
Explanation
So tokens must not contain secrets or personal data beyond what's needed. The signature only protects against changes.