The payload of the token contains claims whose names suggest a secret or personal data, for example a password, a secret, an API key, a card number or a national identity number.

The payload of a signed token is not encrypted. It is only base64url encoded, and anybody who sees the token, including browser extensions, proxies, log files and the user's own device, can decode it with a one-line command.

1. Remove the claims from the token. Keep only what the receiving service needs, typically a subject identifier, roles and the usual registered claims.

2. Look the data up on the server with the subject identifier instead of embedding it.

3. Encrypt the token (JWE) when confidential content has to travel with it.

4. Rotate any secret that was exposed this way.

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
• RFC 8725: JSON Web Token Best Current Practices