Should jwt web token be encrypted?

Question

I was reading article on JWT web token as an access token that is being response to the user. Some of it mention that the web token should be able to be decoded by the user.

Answer 1

JWT are "signed" and therefore its contents are protected from tampering: you cannot change its contents without invalidating them.

You can optionally "encrypt" the contents and therefore turn them visible only to issuer (the entity creating the token) and the consumer (the entity that is destined to use its contents after verification).

There's a standard for that: JWE

Answer 2

JWT (RFC7519) is just a compact way to safely transmit claims from an issuer to the audience over HTTP.

JWT can be:

• signed (JWS - RFC7515)
• encrypted (JWE - RFC7516)
• signed then encrypted (this order is highly recommended). The whole JWS is the payload of the JWE
• encrypted then signed.

It makes sense to encrypt a JWS if you want to keep sensitive information hidden from the bearer (client) or third parties.

The real questions are: does the audience support JWE? If yes, which algorithms are supported?

Answer 3

A token contains user data and acts like a temp storage. It is not good to store sensitive data in a token.

At the first level, you should store the user name and maybe role or something like that. You should not include passwords, so it does not need to be encrypted. Nevertheless, you can encrypt it if you want.