title: Verify JWT on browser
body: <p>I have been reading about <a href="https://jwt.io/" rel="nofollow noreferrer">JWT</a> and I understand it has three parts namely, <code>header</code>, <code>payload</code> and <code>signature</code>. </p>
  
  <p>I keep the hashing algorithm used in headers, basic information in a payload <em>eg. name, age , role, expiry etc</em> in payload and then both of these are base64 encoded and then hashed using the 
   algorithm specified in headers to obtain the JWT</p>
  
  <ol>
  <li>I have a frontend where I can login using <code>username</code> and <code>password</code>.</li>
  <li>The login request goes to a server which authenticates it and returns a JWT. Lets suppose the algo used is HS256 which is a symmetric key algorithm.</li>
  <li>So the server will have the <code>secret key</code> using which the JWT will be generated.</li>
  <li>As part fo login request's response, the browser will have the JWT. </li>
  <li>Now this JWT could be tampered with on the way so before it is used, I should verify the authenticity of JWT.</li>
  <li>To verify, I need the secret key. </li>
  </ol>
  
  <p><strong>Questions:</strong></p>
  
  <ol>
  <li>How do I get this <code>secret key</code> on the frontend?</li>
  <li>The payload can keep any information about a user (Not any sensitive information eg. passwords). Since JWT can be tampered with on the way, is it not dangerous to use the payload information without verifying the JWT on frontend?</li>
  </ol>