Is JWT encoded or encrypted?

JWT (JSON Web Token) is not encrypted, but encoded and signed. It consists of three parts: header, payload, and signature. The header and payload are encoded in Base64Url, which does not provide confidentiality but merely transforms the data into text format. The signature is created using a secret key or a pair of keys to ensure the integrity and authenticity of the token.

Thus, JWT can be easily decoded and its contents read, but it cannot be forged without the signature key. If confidentiality is required, JWT should be additionally encrypted (e.g., JWE).