Your JWT payload is public. Read it before an attacker does.

Here's the sentence most developers learn a little too late: a JWT's header and payload are not...