title: Is it ok to store user credentials in the JWT
body: <p>Is it ok to store user credentials (username / password) in the JWT (so <code>sign</code> it and <code>verify</code> the resulted token later)?</p>
  
  <p>I <a href="https://stackoverflow.com/questions/36622366/how-to-pass-secure-data-like-user-name-password-in-json-web-token">heard</a> that</p>
  
  <blockquote>
    <p>No, it is not secure to send a password in a JWT. This is because the
    JWT claims are simply encoded and can easily be decoded by anyone that
    sees them. It is not secure to store any sensitive information in a
    JWT that returned to a user</p>
  </blockquote>
  
  <p>but I don't know why does the JWT website <a href="https://jwt.io/introduction/" rel="noreferrer">recommends</a> using it for authentication purposes then:</p>
  
  <blockquote>
    <p>When should you use JSON Web Tokens?</p>
    
    <p>Here are some scenarios where JSON Web Tokens are useful:</p>
    
    <p>Authentication: This is the most common scenario for using JWT. Once
    the user is logged in, each subsequent request will include the JWT,
    allowing the user to access routes, services, and resources that are
    permitted with that token. Single Sign On is a feature that widely
    uses JWT nowadays, because of its small overhead and its ability to be
    easily used across different domains</p>
  </blockquote>