JWT把登录信息（也称作令牌）保存在客户端。为了防止客户端的数据造假，保存在客户端的令牌经过了签名处理，而签名的密钥只有服务器端才知道，每次服务器端收到客户端提交过来的令牌的时候都要检查一下签名。

JWT包含以下三部分信息

System.IdentityModel.Tokens.Jwt

var claims = new List<Claim>();
claims.Add(new Claim(ClaimTypes.NameIdentifier, "6"));
claims.Add(new Claim(ClaimTypes.Name, "yzk"));
claims.Add(new Claim(ClaimTypes.Role, "User"));
claims.Add(new Claim(ClaimTypes.Role, "Admin"));
claims.Add(new Claim("PassPort", "E90000082"));
string key = "fasdfad&9045dafz222#fadpio@0232";
DateTime expires = DateTime.Now.AddDays(1);
byte[] secBytes = Encoding.UTF8.GetBytes(key);
var secKey = new SymmetricSecurityKey(secBytes);
var credentials = new SigningCredentials(secKey,SecurityAlgorithms.HmacSha256Signature);
var tokenDescriptor = new JwtSecurityToken(claims: claims,
    expires: expires, signingCredentials: credentials);
string jwt = new JwtSecurityTokenHandler().WriteToken(tokenDescriptor);

string[] segments = jwt.Split('.');
string head = JwtDecode(segments[0]);
string payload = JwtDecode(segments[1]);
Console.WriteLine("---head---");
Console.WriteLine(head);
Console.WriteLine("---payload---");
Console.WriteLine(payload);

string JwtDecode(string s)
{
       s = s.Replace('-', '+').Replace('_', '/');
       switch (s.Length % 4)
       {
              case 2:
                     s += "==";
                     break;
              case 3:
                     s += "=";
                     break;
       }
       var bytes = Convert.FromBase64String(s);
       return Encoding.UTF8.GetString(bytes);
}

通过以上解码代码可以得出Jwt中的内容是明文形式保存的，不要把不能被客户端知道的信息放到JWT中。

string secKey = "fasdfad&9045dafz222#fadpio@0232";
JwtSecurityTokenHandler tokenHandler = new();
TokenValidationParameters valParam = new ();
var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secKey));
valParam.IssuerSigningKey = securityKey;
valParam.ValidateIssuer = false;
valParam.ValidateAudience = false;
ClaimsPrincipal claimsPrincipal = tokenHandler.ValidateToken(jwt,
                     valParam,out SecurityToken secToken);
 foreach (var claim in claimsPrincipal.Claims)
 {
     Console.WriteLine($"{claim.Type}={claim.Value}");
 }

随便用一个密钥来生成一个用户Id等经过篡改后的JWT令牌，用以上代码解码会报签名验证失败错误。