JWT: what is inside a token, and what to check

A JSON Web Token is header.payload.signature. Anyone can read it; only the server can sign it.

The idea

The header says which algorithm signed the token, the payload holds claims like user id and expiry, and the signature proves the server issued it and nothing was changed. The payload is only Base64-encoded, not encrypted, so never put secrets in it.

Code

var handler = new JsonWebTokenHandler();
var result = await handler.ValidateTokenAsync(token, new TokenValidationParameters
{
    ValidIssuer = "https://login.example.com",
    ValidAudience = "orders-api",
    IssuerSigningKey = signingKey,
    ValidateLifetime = true,
});
if (!result.IsValid) return Results.Unauthorized();

Tips

• Always verify the signature with your key and a fixed algorithm; never accept tokens that say they need no signature.
• Check expiry (exp), issuer (iss) and audience (aud).
• Keep access tokens short-lived; revoke with refresh-token rotation or a deny list.
• In browsers, an HttpOnly cookie is harder to steal than a token in localStorage if XSS happens.

In the .NET library

AddAuthentication().AddJwtBearer(...) in ASP.NET Core validates issuer, audience, lifetime and signature for you when configured.