Software engineering · 1 min · daily challenge of 2026-10-28
Is your signed JWT payload actually encrypted?
Learn how signed JWT payloads and signatures work, why base64url encoding matters, and what never to store in them.
Practise Software engineeringMore videos
The quiz
Which statement about a standard signed JWT is true?
- Its payload is encrypted and unreadable
- Anyone can read its payload; the signature only proves it was not altered
- It cannot expire
- It must be stored in a database
Show the answer
B. Anyone can read its payload; the signature only proves it was not altered
Transcript
Assuming JWTs encrypt payloads is wrong; this daily challenge caught people out.
A signed token remains completely readable to anyone who inspects it, while the signature simply proves the claims were never altered.
When your server issues identity claims inside the token, clients return them untouched, allowing the server to check the signature safely.
Now the part most people miss: base64url never encrypts data, so treat payload claims as public, verify signatures, and never store secrets.
Explain this with clarity in interviews: the payload remains openly readable, but the cryptographic signature guarantees that data was not altered.
Pause the video right now and choose: which statement about a standard signed JWT is actually true among A, B, C, or D?
Option B is correct because payload claims stay completely readable, unlike option A states, while the signature confirms nothing was changed.
Save this breakdown right before your upcoming technical interview, and practice daily engineering challenges like this every single morning on InternDoor.
