You have to be careful that you are not leaking sensitive info though, as the JWT payload is meant to be visible on the client as well.