How to verify an ES256 JWT in C# (.NET)

1#:package Microsoft.IdentityModel.JsonWebTokens@8.23.0
2 
3using System.Security.Cryptography;
4using Microsoft.IdentityModel.JsonWebTokens;
5using Microsoft.IdentityModel.Tokens;
6 
7var publicKey = ECDsa.Create();
8publicKey.ImportFromPem(File.ReadAllText("pub.pem"));
9 
10var parameters = new TokenValidationParameters
11{
12    IssuerSigningKey = new ECDsaSecurityKey(publicKey),
13    ValidAlgorithms = [SecurityAlgorithms.EcdsaSha256], // "ES256" and nothing else
14    ValidIssuer = "https://ecdsa.com",
15    ValidateAudience = false, // this token has no aud; set ValidAudience when yours do
16    ClockSkew = TimeSpan.FromSeconds(30), // the default allows five minutes
17};
18 
19TokenValidationResult result = await new JsonWebTokenHandler()
20    .ValidateTokenAsync(File.ReadAllText("token.txt").Trim(), parameters);
21if (!result.IsValid) throw result.Exception; // never read claims from an invalid result
22 
23var jwt = (JsonWebToken)result.SecurityToken;
24Console.WriteLine($"valid ES256 token for {jwt.Subject}, expires {jwt.ValidTo:O}");
25 

1using System.Buffers.Text;
2using System.Security.Cryptography;
3using System.Text;
4 
5static class Jws
6{
7    /// <summary>The ES256 signature check alone: JWS signatures are raw r‖s, .NET's default format.</summary>
8    public static bool Es256SignatureValid(string token, ECDsa publicKey)
9    {
10        string[] parts = token.Split('.');
11        if (parts.Length != 3) throw new FormatException("not a compact JWS");
12        byte[] signingInput = Encoding.ASCII.GetBytes($"{parts[0]}.{parts[1]}"); // the base64url text
13        byte[] signature = Base64Url.DecodeFromChars(parts[2]); // .NET 9+: base64url without padding
14        return publicKey.VerifyData(signingInput, signature, HashAlgorithmName.SHA256);
15    }
16}
17 

How it works

1. #:package pins the NuGet package for a file-based app (dotnet run verify.cs, .NET 10). In a project, add the same package with dotnet add package Microsoft.IdentityModel.JsonWebTokens --version 8.23.0.
2. ECDsaSecurityKey wraps an ECDsa loaded from the SPKI PEM; ValidAlgorithms = [SecurityAlgorithms.EcdsaSha256] refuses every header alg except ES256.
3. ValidateTokenAsync checks signature, issuer and lifetime and returns a result object instead of throwing. Read claims only after IsValid is true.
4. The BCL-only variant shows the mechanism: the signed bytes are the ASCII text header.payload, Base64Url.DecodeFromChars (.NET 9+) decodes the unpadded segment, and VerifyData with its default format reads the 64-byte r‖s directly.

Gotchas

• Audience validation is on by default. A token without aud — or a configuration without ValidAudience — fails with IDX10208 / SecurityTokenInvalidAudienceException (the run shows it). Turn it off only when your tokens genuinely carry no audience.
• A forged token and a token with a disallowed alg both fail with IDX10517: Signature validation failed. The token's kid is missing when the token has no kid. It does not mean you must add a kid; it means no key validated the signature. The detailed reason is hidden as PII until IdentityModelEventSource.ShowPII = true (development only).
• ClockSkew defaults to five minutes, so a token "expires" up to five minutes late. Set it explicitly.
• JsonWebTokenHandler.ReadJsonWebToken and the older JwtSecurityTokenHandler.ReadJwtToken only decode — they check neither signature nor expiry. Do not authorize anything with their output.
• Convert.FromBase64String rejects JWT segments (-, _ and missing padding). Use Base64Url from System.Buffers.Text, or Base64UrlEncoder from the IdentityModel package.

Related recipes

• How to verify an ECDSA signature in C# (.NET)
• How to convert an ECDSA signature between DER and raw in C# (.NET)
• How to verify an ES256 JWT in Java
• How to verify an ES256 JWT in Rust
• How to verify an ES256 JWT in Node.js