Anyone can read the payload; only the signature stops changes. It is valid until its exp unless the server keeps extra state.
JWT
A signed token (header.payload.signature, base64url) carrying claims; signed, not encrypted.
Anyone can read the payload; only the signature stops changes. It is valid until its exp unless the server keeps extra state.