Unverified50% confidenceCautionExact time
The Payload portion of a JWT is by default only Base64-encoded rather than encrypted, and therefore highly sensitive information such as passwords should not be placed in it.
1
Sources
50%
Confidence
Long-term
Relevance
9/11/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedJWT is not encrypted by default (only signed), tokens are difficult to actively revoke once issued, and improper key management can lead to wholesale token forgery.73% similarUnverifiedbase64 不是加密，而是一种完全可逆的编码方式，不提供任何安全性保障67% similarUnverifiedKubernetes Secrets performs only Base64 encoding by default rather than encryption, and requires etcd encryption at rest combined with RBAC permission policies to improve security.66% similarUnverifiedThe CO value in Tencent's slider CAPTCHA is the core encrypted ciphertext, generated by local JS, with a length of approximately 1,600–1,700 characters.63% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/895937API
curl https://kongchang.com/api/v1/knowledge/claims/895937MCP
get_claim(id=895937)