---
title: "How is a JWT validated?"  
description: "How is a JWT validated?"  
author: "Anubhav Sharma"  
published: 2025-06-09  
updated: 2025-06-09  
canonical: https://www.mindstick.com/interview/34221/how-is-a-jwt-validated  
category: "c#"  
tags: ["c#", "authentication", "authorization"]  
reading_time: 4 minutes  

---

# How is a JWT validated?

A **JWT (JSON Web Token)** is validated through a series of steps to ensure it is authentic, untampered, and still valid (not expired).

Here’s how JWT validation works:

## 1. Split the Token

The JWT comes as a string like this:

```plaintext
<Header>.<Payload>.<Signature>
```

The system splits it into three Base64Url-encoded parts.

## 2. Verify the Signature

The server uses the **header’s algorithm** (e.g., HS256 or RS256) and a **secret key** (or public key) to **recompute the signature**:

```plaintext
computedSignature = sign(base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)
```

Then it checks:

```plaintext
computedSignature == signatureFromToken
```

If they don’t match, the token was **tampered with** ⇒ reject it.

## 3. Check Expiration (`exp` claim)

JWTs typically contain an `exp` (expiration) claim:

```plaintext
"exp": 1717941723
```

This is a **Unix timestamp**. If the current time is past this timestamp, the token is expired.

> Expired tokens are **invalid**, even if the signature is correct.

## 4. Validate Other Claims (optional)

You can validate any other claims as needed:

| Claim | Purpose |
| --- | --- |
| `iss` | Issuer – who issued the token |
| `aud` | Audience – who it was issued for |
| `nbf` | Not before – when the token becomes valid |
| `iat` | Issued at – when the token was created |

If any of these don’t match expected values ⇒ reject the token.

## 5. Use the Payload Data

If the token passes all validations, the server **trusts the payload** (e.g., `userId`, `roles`, etc.) and grants access.

## Summary of JWT Validation Steps

| Step | What it checks |
| --- | --- |
| **Signature** | Token integrity and authenticity |
| **Expiration (**`exp`**)** | Valid time window |
| **Claims (optional)** | Correct issuer, audience, etc. |

## Answers

### Answer by Anubhav Sharma

A **JWT (JSON Web Token)** is validated through a series of steps to ensure it is authentic, untampered, and still valid (not expired).

Here’s how JWT validation works:

## 1. Split the Token

The JWT comes as a string like this:

```plaintext
<Header>.<Payload>.<Signature>
```

The system splits it into three Base64Url-encoded parts.

## 2. Verify the Signature

The server uses the **header’s algorithm** (e.g., HS256 or RS256) and a **secret key** (or public key) to **recompute the signature**:

```plaintext
computedSignature = sign(base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)
```

Then it checks:

```plaintext
computedSignature == signatureFromToken
```

If they don’t match, the token was **tampered with** ⇒ reject it.

## 3. Check Expiration (`exp` claim)

JWTs typically contain an `exp` (expiration) claim:

```plaintext
"exp": 1717941723
```

This is a **Unix timestamp**. If the current time is past this timestamp, the token is expired.

> Expired tokens are **invalid**, even if the signature is correct.

## 4. Validate Other Claims (optional)

You can validate any other claims as needed:

| Claim | Purpose |
| --- | --- |
| `iss` | Issuer – who issued the token |
| `aud` | Audience – who it was issued for |
| `nbf` | Not before – when the token becomes valid |
| `iat` | Issued at – when the token was created |

If any of these don’t match expected values ⇒ reject the token.

## 5. Use the Payload Data

If the token passes all validations, the server **trusts the payload** (e.g., `userId`, `roles`, etc.) and grants access.

## Summary of JWT Validation Steps

| Step | What it checks |
| --- | --- |
| **Signature** | Token integrity and authenticity |
| **Expiration (**`exp`**)** | Valid time window |
| **Claims (optional)** | Correct issuer, audience, etc. |


---

Original Source: https://www.mindstick.com/interview/34221/how-is-a-jwt-validated

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.