21/08/2026
Anyone can read your JWT. That's not a bug - that's the design.
A JWT is three chunks split by dots. That middle chunk, the payload, isn't encrypted. It's base64. No key, no cracking, one function call and your user ID and role are sitting there in plain text.
So why is it safe? The third chunk. The server takes the header and payload, adds a secret key that never leaves the server, and hashes it. That's the signature. Change one character of the payload and the signature stops matching.
Which is why editing your role from user to admin doesn't work. The server recomputes the signature from what you sent, it won't match, and you get a 401.
Two catches nobody mentions: never put secrets in the payload, because it's readable. And you can't un-issue a token early, so keep the expiry short.
Comment "JWT" for the auth checklist.
[ :ld-how-jwt-auth-works-signed-not-encrypted-FB]