Web Security · Middle · Question 40 of 75

Is the payload of a signed JWT (JWS) secret?

✓Correct answer: No: it's only Base64URL-encoded, so anyone holding the token can read it
2Yes, the signature encrypts it
3Yes, but only the browser can decode it

Explanation

A signature protects integrity, not confidentiality. Don't put sensitive data in a JWT unless it's encrypted (JWE).

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.