A JWT access token is signed with HS256. Which statement about its payload is true?

Anyone holding the token can decode and read the payload. A signed JWT (called a JWS) is only base64url-encoded, not encrypted. So anyone who has the token can see its claims (the data inside it). The signature proves the token was not changed and shows who made it. It hides nothing.

"The payload is encrypted with the secret and unreadable without it" is the tempting wrong answer. HS256 signs the payload. It doesn't encrypt it. When claims must stay private, use a JWE (an encrypted JWT). Never put secrets in a JWS payload.