How does jwt decode work?

Question

JavaScript

Hello! I use javascript lib jsonwebtoken , sign the token with the help of the Word secret like this, jwt.sign(data, secret);
everything is ok, but if I put the token in the decode function, jwt.decode(token);then it decrypts it easily, how does this happen? if I didn't pass secret? the concept of such tokens is not entirely clear, if it is so easy to read their contents without knowing the secret, plz tell me how it works

Answer 1

The token is stored in the clear, it's just base64.
Secret is used to get the signature of the data so that no one can change it.
The token looks like this {header}.{payload}.{hash} separated by a dot.
header
payload
hash

let content = base64UrlEncode(header) + "." + base64UrlEncode(payload);
let hash = HMACSHA256(content, secret);

And also visit the resource https://jwt.io/
PS, if you need to encrypt data, use JWS instead of JWT