Which statement about a standard signed JWT (JWS) is true?
Options
- Its payload is encrypted, so nobody except the server can read it
- Its payload is only base64url-encoded; the signature stops edits (Correct option)
- It can be revoked at once on the server side by default
- It must always be stored in the localStorage of the browser
Answer
Its payload is only base64url-encoded; anyone can read it, but the signature prevents tampering
Why
A JWT has three parts: header.payload.signature. The payload is only encoded (base64url), NOT encrypted: anyone can decode and read it (try jwt.io).
The signature, made with the server's secret key, proves the token was issued by the server and not modified. If someone changes the payload, the signature no longer matches.
So never put passwords or secrets in a JWT.
Remember
JWT payload is readable by anyone; the signature only stops tampering.