Question: why jwt is not secure?
Answer: The contents in a json web token (JWT) are not inherently secure, but there is a built-in feature for verifying token authenticity. ... The asymmetric nature of public key cryptography makes JWT signature verification possible. A public key verifies a JWT was signed by its matching private key.