JWT JSON Structure — Interview Questions
⚡ Short Answer
A JWT is three Base64URL-encoded parts joined by dots: header.payload.signature. The header and payload are JSON objects — the header names the algorithm/type, the payload holds claims (sub, iss, exp, roles). The signature verifies integrity. It's signed, not encrypted, so anyone can decode the JSON; never put secrets in the payload.
☕Coffee Chat Question
Concept Made Simple
“How does JSON structure a JWT (JSON Web Token)?”
🧠Mind Map Answer
Remember It Faster
⌨️Hands-on Keyboard
Learn by Doing
// Header (before Base64URL encoding)
{ "alg": "HS256", "typ": "JWT" }
// Payload / claims
{ "sub": "101", "role": "admin", "exp": 1735689600 }
// Token = base64url(header) . base64url(payload) . signature🔥What If?
Think Beyond the Expected
Since the JWT payload is only Base64-encoded JSON, can anyone read it?
Yes — Base64URL is encoding, not encryption, so anyone can decode and read the header and payload JSON. The signature only guarantees the token wasn't tampered with, not confidentiality. Never store sensitive data (passwords, PII, secrets) in the payload; if you need secrecy, use an encrypted token (JWE) or keep secrets server-side.
😂Real World
Paste any JWT into jwt.io and you'll see the header/payload JSON decoded instantly — a live reminder that claims are readable. That's why access tokens carry only non-sensitive claims (user id, roles, expiry) and short lifetimes.
🎯Interviewer's Expectation
Keywords they're listening for:
⚠️Common Mistakes
- ✗Thinking the payload is encrypted/private
- ✗Storing secrets or PII in claims
- ✗Ignoring exp / not expiring tokens
✅Best Practices
- ✓Keep only non-sensitive claims in the payload
- ✓Always set and check exp
- ✓Use JWE if the payload must be confidential
🔁Follow-up Questions
- 1Why is a JWT signed but not encrypted?
- 2What are registered claims like exp, iss, aud?
- 3How does the server verify the signature?
🧩Related Technologies
Continue Learning with AI
Take this question deeper with your favourite AI assistant. Pick a depth, copy the prompt, or open it directly — AI is your learning companion, not a shortcut.
Plain-language foundations
I'm preparing for a software engineering interview and want to understand this from scratch, as a beginner. Topic: Advanced (JSON) Interview question: "How does JSON structure a JWT (JSON Web Token)?" Please: 1. Explain the core idea in simple, plain language, using an everyday analogy. 2. Define any technical terms you use. 3. Walk through one small, concrete example. 4. Finish with a single sentence I can easily remember. Keep the tone friendly and assume I'm new to this topic.
Was this answer helpful?
⭐ Featured Products
Support our platform by exploring our recommended products.
As an Amazon affiliate, purchases through these links may earn us a small commission — at no extra cost to you. It helps keep Full Stack Interview Guru free.