With Base64 decode i can read the hashed content

[alessandroarioli]

I have this strange behaviour:

JWT.encode({name: 'alessandro'}, 'itw', 'HS256')
 => "eyJhbGciOiJIUzI1NiJ9.eyJuYW1lIjoiYWxlc3NhbmRybyJ9.h1ZMLLxLKpL2wfEd6k2ZIuAzh_YKlCuFkY9IOZeE2qE" 
2.3.1 :021 > Base64.decode64("eyJhbGciOiJIUzI1NiJ9.eyJuYW1lIjoiYWxlc3NhbmRybyJ9.h1ZMLLxLKpL2wfEd6k2ZIuAzh_YKlCuFkY9IOZeE2qE")
 => "{\"alg\":\"HS256\"}{\"name\":\"alessandro\"}\x87VL,\xBCK*\x92\xF6\xC1\xF1\x1D\xEAM\x99\"\xE03\x85\x82\xA5\n\xE1dc\xD2\x0Ee\xE16\xA8"

i can see the plain payload content.
Also using the RS256 with Open SSL key:

2.3.1 :022 > JWT.encode({name: "alessandro"}, OpenSSL::PKey::RSA.generate(2048), 'RS256') => "eyJhbGciOiJSUzI1NiJ9.eyJuYW1lIjoiYWxlc3NhbmRybyJ9.JZ4EaZ7x-n5UXe67saFS_nOJsSZC4tOUqytC3SDnSsNeYqNO6uamrTY_ZHIBA9kNH3sUasMunl_rLAh8Rx421s8u2MkedgcjvlaWGroKIjd3bQBIJ9LjX40FT9m5ClMNcurcha-QzTPVux_-rE8ytUeFd01dD3iFBHgzc4O7wdWnuU63T56xhRjfhGO74jg5HR0aQCt2KMk3leycQ12f36hQe-RrL3bYlSz3V-8ZQ8VtXwsIFjbWEaWCbmQgjExvQzIrFDzFOUuqFDnVhv1LFc3NWaF3OnlGlH7YrtIokAmY_8GXNe3ZP5g3RUpI_cjstjZ2I13TKr8XtN-xor8-Uw" 
2.3.1 :023 > Base64.decode64("eyJhbGciOiJSUzI1NiJ9.eyJuYW1lIjoiYWxlc3NhbmRybyJ9.JZ4EaZ7x-n5UXe67saFS_nOJsSZC4tOUqytC3SDnSsNeYqNO6uamrTY_ZHIBA9kNH3sUasMunl_rLAh8Rx421s8u2MkedgcjvlaWGroKIjd3bQBIJ9LjX40FT9m5ClMNcurcha-QzTPVux_-rE8ytUeFd01dD3iFBHgzc4O7wdWnuU63T56xhRjfhGO74jg5HR0aQCt2KMk3leycQ12f36hQe-RrL3bYlSz3V-8ZQ8VtXwsIFjbWEaWCbmQgjExvQzIrFDzFOUuqFDnVhv1LFc3NWaF3OnlGlH7YrtIokAmY_8GXNe3ZP5g3RUpI_cjstjZ2I13TKr8XtN-xor8-Uw")
 => "{\"alg\":\"RS256\"}{\"name\":\"alessandro\"}%\x9E\x04i\x9E\xF1\x9F\x95\x17{\xAE\xEChT\xA78\x9B\x12d.-9J\xB2\xB4-\xD2\x0Et\xAC5\xE6*4\xEE\xAEjj\xD3a\x91\xC8\x04\x0Fd4}\xECQ\xAB\f\xBAyk,\b|G\x1E6\xD6\xCF.\xD8\xC9\x1Ev\a#\xBEV\x96\x1A\xBA\n\"7wm\x00H'\xD2\xE3_\x8D\x05O\xD9\xB9\nS\rr\xEA\xDC\x85\xA43L\xF5n\xC6\xB1<\xCA\xD5\x1E\x15\xDD5t=\xE2\x14\x11\xE0\xCD\xCE\x0E\xEF\aV\x9E\xE5:\xDD>z\xC6\x14c~\x11\x8E\xEF\x88\xE0\xE4tti\x00\xAD\xD8\xA3$\xDEW\xB2q\rv\x7F~\xA1A\xE4k/v\xD8\x95,\xF7W\xC6P\xF1[W\xC2\xC2\x05\x8D\xB5\x84i`\x9B\x99\b#\x13\e\xD0\xCC\x8A\xC5\x0F1NR\xEA\x85\x0Eua\xBFR\xC5ssVh]\xCE\x9EQ\xA5\x1F\xB6+\xB4\x8A$\x02f<\x19s^\xDD\x93\xF9\x83tT\xA4\x87#\xB2\xD8\xD9\xD8\x8DwL\xAA\xFC^\xD3q\xA2\xBF\x14"

It's looks like is appending the hash to the payload ... I'm doing something wrong?

[excpt]

That behavior you're seeing is correct. JWT only signs the payload.
The algorithms you're selecting for the normal JWT.encode are only for the signature generation and verification.

If you want to encrypt your payload you have to dive into JWE here: https://github.com/jwt/ruby-jwe

[alessandroarioli]

Ok, i thought that the library did the entire job. Thank you