MediumExperience level: 3-5 years · 8-15 years1 min read

JWT JSON Structure — Interview Questions

Reviewed by Gurusankar M.

Asked inAmazonMicrosoftDeloitteAccenture
#json#jwt#token#claims#authentication
Report issue

Short Answer

A JWT is three Base64URL-encoded parts joined by dots: header.payload.signature. The header and payload are JSON objects — the header names the algorithm/type, the payload holds claims (sub, iss, exp, roles). The signature verifies integrity. It's signed, not encrypted, so anyone can decode the JSON; never put secrets in the payload.

On this page

Concept Made Simple

Coffee Chat Question

“How does JSON structure a JWT (JSON Web Token)?”

Remember It Faster

Mind Map Answer

Header (JSON)
{ alg, typ } — algorithm & type
Payload (JSON)
claims: sub, iss, exp, roles
Signature
verifies integrity (not secrecy)
Format
base64url(header).base64url(payload).sig

Learn by Doing

Hands-on Keyboard

json
// Header (before Base64URL encoding)
{ "alg": "HS256", "typ": "JWT" }

// Payload / claims
{ "sub": "101", "role": "admin", "exp": 1735689600 }

// Token = base64url(header) . base64url(payload) . signature

Think Beyond the Expected

What If?

Since the JWT payload is only Base64-encoded JSON, can anyone read it?

Yes — Base64URL is encoding, not encryption, so anyone can decode and read the header and payload JSON. The signature only guarantees the token wasn't tampered with, not confidentiality. Never store sensitive data (passwords, PII, secrets) in the payload; if you need secrecy, use an encrypted token (JWE) or keep secrets server-side.

Real World

Paste any JWT into jwt.io and you'll see the header/payload JSON decoded instantly — a live reminder that claims are readable. That's why access tokens carry only non-sensitive claims (user id, roles, expiry) and short lifetimes.

Interviewer's Expectation

Keywords they're listening for:

  • header.payload.signature
  • header & payload are JSON
  • Base64URL, not encrypted
  • standard claims (sub/iss/exp)
  • no secrets in payload

Common Mistakes

  • Thinking the payload is encrypted/private
  • Storing secrets or PII in claims
  • Ignoring exp / not expiring tokens

Best Practices

  • Keep only non-sensitive claims in the payload
  • Always set and check exp
  • Use JWE if the payload must be confidential

Follow-up Questions

  1. Why is a JWT signed but not encrypted?
  2. What are registered claims like exp, iss, aud?
  3. How does the server verify the signature?

Continue Learning with AI

Take this question deeper with your favourite AI assistant. Pick a depth, copy the prompt, or open it directly — AI is your learning companion, not a shortcut.

Plain-language foundations

I'm preparing for a software engineering interview and want to understand this from scratch, as a beginner.

Topic: Advanced (JSON)
Interview question: "How does JSON structure a JWT (JSON Web Token)?"

Please:
1. Explain the core idea in simple, plain language, using an everyday analogy.
2. Define any technical terms you use.
3. Walk through one small, concrete example.
4. Finish with a single sentence I can easily remember.

Keep the tone friendly and assume I'm new to this topic.
Open inChatGPTGeminiClaude

Was this answer helpful?

Affiliate links

Tools for Your Developer Workspace

Equipment for a comfortable, productive setup.

As an Amazon Associate I earn from qualifying purchases.