- 1 current stop: learning
- 2 upcoming
- 3 upcoming
- 4 upcoming
- 5 upcoming
Finish after stop 5
Stop 1 of 5 · Post office: sealing the envelope
Trick to keep in mind+3 XP
A signed JWT is a postcard with a wax seal: anyone can read it, but tampering shows.
The header and payload are only base64url-encoded JSON, a reversible encoding that needs no key. The signature proves the text was not edited after signing; it hides nothing. Where secrecy matters there is a separate encrypted form (JWE), but an everyday signed token should be treated as public text.
Read it once, then a question tests whether the trick stuck.