Is your JWT encrypted? (No — and that trips up a lot of devs)

#security #authentication #webdev #api

Common misconception: "JWTs are encrypted, so I can store data in them."

Reality: a standard JWT's header and payload are only Base64-encoded —
fully readable by anyone. Paste one into any decoder and the claims fall right
out. The signature proves the token wasn't tampered with; it does NOT hide
the contents.

So: never put secrets in a JWT payload.

While we're clearing up auth confusion, three things that look similar but
aren't:
• Encoding (Base64) → representation, reversible, no key
• Encryption (AES) → protection, reversible with a key
• Hashing (SHA-256) → one-way, can't be reversed (why passwords are hashed)

I wrote a from-scratch guide to API authentication — Basic Auth, API keys,
bearer tokens, JWT, and OAuth 2.0 — plus how to actually test each one:

👉 https://www.orbittest.dev/blog/api-authentication-oauth-jwt-tokens

What auth method does your current project use?