Keep sensitive data out of JWT claims

A JWT may contain privacy-sensitive information, and when it does, RFC 7519 requires measures to prevent disclosure to unintended parties. One approach is to use an encrypted JWT and authenticate the recipient; another is to transmit JWTs containing unencrypted privacy-sensitive information only over protocols that use encryption with endpoint authentication, such as TLS. The simplest way of minimizing privacy issues, per the RFC, is omitting privacy-sensitive information from the JWT altogether. Because a signed-only JWT's claims are readable by anyone holding the token, treating claim contents as public by default is Koskamo editorial guidance consistent with that advice. RFC 8725 adds a related caution at the encryption layer: many encryption algorithms leak the plaintext length, and compression attacks are especially powerful when attacker-controlled data shares a compression space with secret data, so compression SHOULD NOT be applied before encryption. Scope: JWT security. Reviewed October 4, 2026.