Products

Data Converter Cleaner TUC - Unit Converter Import Export Survey Manager Tweet Controller

Developer

Article Blog Forum Interview Beginner News Startup Quiz

Users

Career

Apply Job Internship

Pricing

How is a JWT validated?

Anubhav Sharma 641 09 Jun 2025

Anubhav Sharma 09 Jun 2025

A JWT (JSON Web Token) is validated through a series of steps to ensure it is authentic, untampered, and still valid (not expired).

Here’s how JWT validation works:

1. Split the Token

The JWT comes as a string like this:

<Header>.<Payload>.<Signature>

The system splits it into three Base64Url-encoded parts.

The server uses the header’s algorithm (e.g., HS256 or RS256) and a secret key (or public key) to recompute the signature:

computedSignature = sign(base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)

Then it checks:

computedSignature == signatureFromToken

If they don’t match, the token was tampered with ⇒ reject it.

JWTs typically contain an exp (expiration) claim:

"exp": 1717941723

This is a Unix timestamp. If the current time is past this timestamp, the token is expired.

Expired tokens are invalid, even if the signature is correct.

You can validate any other claims as needed:

Claim	Purpose
`iss`	Issuer – who issued the token
`aud`	Audience – who it was issued for
`nbf`	Not before – when the token becomes valid
`iat`	Issued at – when the token was created

If any of these don’t match expected values ⇒ reject the token.

If the token passes all validations, the server trusts the payload (e.g., userId, roles, etc.) and grants access.

Step	What it checks
Signature	Token integrity and authenticity
Expiration (`exp`)	Valid time window
Claims (optional)	Correct issuer, audience, etc.

Markdown for AI

A clean, structured version of this page for AI assistants and LLMs.