Is it ok to store roles in jwt token?

Question

JSON Web Token

Can you please tell me if it is normal and generally possible to store roles in a jwt token? For example, this is how payload looks like

{
  "id": "1",
  "role": "admin"
}

After all, it's easier to use roles and not make unnecessary requests to the database. Also from a security point of view is this ok?

Answer 1

JWT does not guarantee security for sensitive data as it does not hide or encrypt payload content by default. Essentially, tokens are used for authorization.
Therefore, storing the role in the payload of the token is the norm. And the password, pin from the card or home address is not the norm.