What is transmitted in the Payload of a JWT token?

In the Payload of a JWT (JSON Web Token), a set of claims is transmitted, which contains information about the user and additional data necessary for authentication and authorization. The Payload usually includes:

• Registered claims — standard fields, such as iss (issuer), sub (subject), aud (audience), exp (expiration), iat (issued at).
• Public claims — publicly accessible fields that can be defined by the user, such as username, role, email.
• Private claims — user-defined fields specific to a particular application.

The Payload does not contain secret information, as it is encoded in base64 but not encrypted. Therefore, sensitive data should not be placed there without additional encryption.

Example of a JWT Payload:

{
  "sub": "1234567890",
  "name": "Иван Иванов",
  "admin": true,
  "iat": 1516239022
}