OP is most likely using "JWT" to refer to a JWS - the most common form of JWT by a very wide margin. JWSes are not encrypted, only signed, so it is true that y

OP is most likely using "JWT" to refer to a JWS - the most common form of JWT by a very wide margin. JWSes are not encrypted, only signed, so it is true that you must not put sensitive information inside a JWS. You might want to use a JWE, but that is not in scope for the article.