Can someone steal my JWT?

You can put all the dev and staging JWTs you want in to jwt.io at no risk if those things aren’t available to the outside world . Agreed. This pretty much applies with any data & tool. If the data is extra sensitive, make extra sure the tool you are using is secure.2 Eyl 2020

JWT tokens provide secure access to an authenticated user, and attackers are always looking for ways to steal these tokens and quickly gain access by impersonating a consumer.

Because JWTs are just URL safe strings , they’re easy to pass around via URL parameters, etc. They contain JSON-encoded data. This means you can have your JWT store as much JSON data as you want, and you can decode your token string into a JSON object. This makes them convenient for embedding information.20 Haz 2018