JWT Structure Explained — Header, Payload, Signature
Fast recall
Quick revision
Core answer
Three base64url parts separated by dots; header.algorithm + type; payload claims (iss, sub, exp, aud); signature binds them
Reading the payload and trusting it without verifying the signature — the payload is base64, not encrypted, and modifiable without signature check
Call out none-algorithm attacks and show a 5-line decode function for the payload (for client-side UX, not trust)
Interview-ready guide
Interview answer
Open (15–20 seconds): Restate the question and give the one-sentence definition.
Body (45–60 seconds): Walk through Three base64url parts separated by dots; header.algorithm + type; payload claims (iss, sub, exp, aud); signature binds them as a story: what runs, what breaks, what you log/measure.
Pitfall (15 seconds): Call out Reading the payload and trusting it without verifying the signature — the payload is base64, not encrypted, and modifiable without signature check — interviewers reward honesty about real bugs.
Finish (15–20 seconds): Add Call out none-algorithm attacks and show a 5-line decode function for the payload (for client-side UX, not trust), then offer a trade-off question back (“do you optimize for TTFB or TTI here?”).
JWT Structure Explained — Header, Payload, Signature
Direct Answer
What is the structure of a JWT? Explain header, payload, and signature.
In one line: name the mechanism, where it applies (the browser, network, and server contract (headers, cookies, streams)), and the user-visible outcome.
Interviewers dig into: Three base64url parts separated by dots; header.algorithm + type; payload claims (iss, sub, exp, aud); signature binds them.
Classic weak answer: Reading the payload and trusting it without verifying the signature — the payload is base64, not encrypted, and modifiable without signature check.
Senior finish: Call out none-algorithm attacks and show a 5-line decode function for the payload (for client-side UX, not trust).
Common Mistakes & Pitfalls
Reading the payload and trusting it without verifying the signature — the payload is base64, not encrypted, and modifiable without signature check
Check your understanding
Answer these without looking back at the article.
- Is JWT encrypted or just signed?
- What is the 'none' algorithm attack?
- What are standard claims (iss, sub, exp)?
- How do refresh tokens differ from access tokens?
Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.