title: If you can decode JWT, how are they secure?
body: <p>If I get a <a href="https://jwt.io/" rel="noreferrer">JWT</a> and I can decode the payload, how is that secure? Couldn't I just grab the token out of the header, decode and change the user information in the payload, and send it back with the same correct encoded secret?</p>
  
  <p>I know they must be secure, but I just would really like to understand the technologies. What am I missing?</p>