Your JWT payload is public. Read it before an attacker does.

Here's the sentence most developers learn a little too late: a JWT's header and payload are not encrypted. They're Base64. Anyone who can see your token can read every field inside it — your user ID, your role, your custom claims.

Source: [Dev.to](https://dev.to/developer_tech/your-jwt-payload-is-public-read-it-before-an-attacker-does-3ck)