---
title: "How does JWT (JSON Web Token) ensure that the token has not been tampered with?"  
description: "How does JWT (JSON Web Token) ensure that the token has not been tampered with?"  
author: "ICSM Computer"  
published: 2025-07-27  
updated: 2025-07-27  
canonical: https://www.mindstick.com/forum/161829/how-does-jwt-json-web-token-ensure-that-the-token-has-not-been-tampered-with  
category: "authentication"  
tags: ["authentication", "authorization"]  
reading_time: 1 minute  

---

# How does JWT (JSON Web Token) ensure that the token has not been tampered with?

How does [JWT](https://www.mindstick.com/interview/34220/what-are-the-parts-of-a-jwt) ([JSON Web](https://www.mindstick.com/forum/159294/create-an-express-js-server-route-to-handle-user-login-authentication-using-jwt-json-web-tokens) [Token](https://www.mindstick.com/forum/159447/manage-token-expired-in-mern-auth)) ensure that the token has not been tampered with?

## Replies

### Reply by Anubhav Sharma

**How does JWT ([JSON](https://www.mindstick.com/forum/34446/convert-json-string-to-object) [Web](https://www.mindstick.com/articles/12783/the-ultimate-bunch-of-free-web-design-resources) Token) ensure that the token has not been tampered with?**

1. The token is **signed** using a **secret key** or **private key** (HMAC or RSA).
2. If the signature does not match when the server verifies it, the token is considered invalid.


---

Original Source: https://www.mindstick.com/forum/161829/how-does-jwt-json-web-token-ensure-that-the-token-has-not-been-tampered-with

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.