Okay - rereading your comments - looks like you have misinterpreted this one. "A signed JWT is known as a JWS (JSON Web Signature) and an encrypted JWT is know

Okay - rereading your comments - looks like you have misinterpreted this one. "A signed JWT is known as a JWS (JSON Web Signature) and an encrypted JWT is known as a JWE (JSON Web Encryption)" This is a correct statement. This does not mean JWS is a JWT all the time. This is well highlighted in the blog link I shared with you: https://medium.facilelogin.com/jwt-jws-and-jwe-for-not-so-dummies-b63310d201a3 https://medium.facilelogin.com/jwt-jws-and-jwe-for-not-so-du... "Yes, you read it correctly, the payload of a JWS necessarily need not to be JSON - if you’d like it can be XML too."