Is it safe to encrypt my JWT authentication token client side if I don't store the key?

Question

I am planning on encrypting my JWT access tokens and storing it in AsyncStorage (React Native). I will be using a PIN code to encrypt the token and request the PIN code on every app startup. I will decrypt the access token with the PIN code and store it in my state for later use.

Would this be a secure approach?

Answer 1

First of all, JWT does not encrypt data (ie Header and Payload parts of the token). It only encodes using Base64Url, which can be decoded without any secret keys.

JWT is used in network request where the Signature part is signed/encrypted to ensure the header and payload data is not manipulated on the way.

So if you want to securely store your access token, JWT is not helping you. You may try bcrypt to encrypt your data and use the PIN as crypt-salt.