JWTs are secure only if used correctly. I created a course on JWT best practices. This will help you understand how to work with JWTs to maintain the best levels of security. Have a look at the free course here: https://curity.io/resources/webinars/course-jwt-security-best-practice/ (you have to register to watch it). If you're more of a reader than a listener, you can have a look at the article that describes the same subject: https://curity.io/resources/learn/jwt-best-practices/