How is a JWT validated?
156
09-Jun-2025
Updated on 09-Jun-2025
Anubhav Kumar
09-Jun-2025A JWT (JSON Web Token) is validated through a series of steps to ensure it is authentic, untampered, and still valid (not expired).
Here’s how JWT validation works:
1. Split the Token
The JWT comes as a string like this:
The system splits it into three Base64Url-encoded parts.
2. Verify the Signature
The server uses the header’s algorithm (e.g., HS256 or RS256) and a secret key (or public key) to recompute the signature:
Then it checks:
If they don’t match, the token was tampered with ⇒ reject it.
3. Check Expiration (
expclaim)JWTs typically contain an
exp(expiration) claim:This is a Unix timestamp. If the current time is past this timestamp, the token is expired.
4. Validate Other Claims (optional)
You can validate any other claims as needed:
issaudnbfiatIf any of these don’t match expected values ⇒ reject the token.
5. Use the Payload Data
If the token passes all validations, the server trusts the payload (e.g.,
userId,roles, etc.) and grants access.Summary of JWT Validation Steps
exp)