Your Google Authenticator export QR code is not encrypted
The "Transfer accounts" QR is base64 protobuf — every 2FA seed in plain sight. Here is the format, the risk, and a browser-only decoder that reads it.
Tag
generator
2posts
JWT vs OAuth2 tokens: why claims matter for backend security
OAuth2 is a flow, JWT is a format — and neither one authorises anything. The claims your backend verifies and validates are what actually decide access.