A JWT is signed, not sealed: the signature proves it is genuine and untampered, but everyone can read the payload.
Validate the signature, the expiry, and the issuer before you trust a single claim: and never write a secret on something everyone can read.
Short-lived access token for every call, long-lived refresh token to renew it, and rotate the refresh token so theft is single-use and detectable.
Prefer an HttpOnly, Secure, SameSite cookie so JavaScript cannot steal the token; localStorage is one XSS away from losing everything.