By default, the signed items in a generated token are just a date-time stamp and a unique sequence number. For enhanced security you can use the ExtraDataToSign property to additionally set the username in the token; KeyMaster.NET will then digitally sign the username. This protects against external attempts to tamper with the token by modifying the username, since when Liberator receives the token it will check that the user name and its decrypted signature match.