What should and should not go inside a JWT payload?

Q: What should and should not go inside a JWT payload?

// Good payload — minimal, stable, non-sensitive claims const payload = { sub: user.id, // subject (standard claim) email: user.email, // low-sensitivity identifier roles: user.roles, // for RBAC guards — stable and compact jti: randomUUID(), // JWT ID — enables per-token revocation // iat and exp are added automatically by jsonwebtoken }; // Bad payload — never do this const payload = { sub: user.id, password: user.password, // NEVER — token is readable without the secret creditCard: user.card, // NEVER — sensitive PII ssn: user.ssn, // NEVER — sensitive PII fullProfile: user, // NEVER — too large, stale risk, leaks data }; JWTs are Base64url-encoded — not encrypted by default; anyone with the token can read the payload. Include only what guards and services need to avoid a database lookup on every request. jti (JWT ID) enables per-token revocation via a Redis blacklist without invalidating all tokens. Avoid embedding frequently-changing data like permissions — stale data in long-lived tokens causes bugs. Use JWE (JSON Web Encryption) if the payload must contain sensitive data and cannot be avoided.

Difficulty: 5/10

JWT claims, NestJS Auth Guard, Security best practices

Include sub (user ID), email, roles, iat, exp, and jti for revocation. Keep payloads small — they travel with every request. Never include passwords, sensitive PII, credit card numbers, or SSNs. JWTs are Base64-encoded and readable by anyone who holds the token without needing the secret.

Good vs bad JWT payload examples

JWT payload rules:

1
JWTs are Base64url-encoded — not encrypted by default; anyone with the token can read the payload.
2
Include only what guards and services need to avoid a database lookup on every request.
3

What should and should not go inside a JWT payload?

Include sub (user ID), email, roles, iat, exp, and jti for revocation. Keep payloads small — they travel with every request. Never include passwords, sensitive PII, credit card numbers, or SSNs. JWTs are Base64-encoded and readable by anyone who holds the token without needing the secret.

Scenario Questions

Follow-up Questions