What are the three components of a JWT?
Tests if you know JWT structure beyond library usage. A strong answer lists header, payload, and signature; notes Base64Url encoding; and gives a registered claim like exp. A red flag is confusing signing with encryption.
What's really being asked
Whether a candidate knows the mechanical structure of a JWT or just treats it as an opaque string from a library. At senior level this is table stakes, but interviewers use it to screen for security hygiene: do you know that a signature is not encryption, that the payload is visible, and that the header drives trust.
The full answer
First, name the three dot-separated parts: the JOSE header, the payload, and the signature. Second, explain the header contains metadata like the signing algorithm and token type. Third, explain the payload is a JSON object containing claims, which can be registered, public, or private. Fourth, explain the signature is computed over the encoded header and encoded payload using the algorithm specified in the header and a secret or key, and it provides integrity and authenticity, not confidentiality. Fifth, give a concrete registered claim example such as exp for expiration time, iat for issued at, iss for issuer, sub for subject, or aud for audience.
The mistakes people make
Confusing the signature with encryption and stating that JWTs hide their payload. Claiming there are only two parts or omitting the header entirely. Describing the payload as encrypted by default. Saying the secret is sent inside the token. Naming a claim that does not exist in RFC 7519 or describing custom application data as standard claims without distinction.
What usually comes next
How would you handle token revocation in a stateless architecture? What is the difference between JWS and JWE? Why should you avoid the none algorithm? How do you validate a JWT signature on the server? What happens if the client modifies the payload before sending it back?
A concrete example
A typical JWT header is Base64Url-encoded and contains alg: HS256 and typ: JWT. The payload contains sub: user_123, exp: 1718900000, and iat: 1718800000. The signature is an HMACSHA256 hash of the encoded header, a dot, and the encoded payload, signed with a server-side secret. Anyone can Base64Url-decode the first two parts to read the claims, but only the server can produce or verify the signature.
Interview question
Which statement accurately describes the structure and security properties of a typical signed JWT's three dot-separated parts?
- a.The payload defines the signing algorithm, the header holds user claims, and the signature is an encrypted hash that hides the payload content.
- b.The header stores the server secret, the payload is encrypted by default, and the signature proves the user's identity to the client.
- c.All three parts are Base64Url-encrypted so only the server can read them, the signature is optional, and the payload contains the shared secret.
- d.The header specifies the algorithm and token type, the payload carries visible claims such as exp, and the signature provides integrity but not confidentiality.Correct
Why? this is the answer
The header contains metadata like alg and typ, the payload carries claims such as exp that anyone can read by Base64Url-decoding, and the signature ensures integrity without confidentiality. The most tempting distractor confuses encoding with encryption or swaps the roles of the header and payload, which are exactly the misconceptions the card flags as red flags.
Just read this? Test yourself on what you have been reading.
Read the original → rfc-editor.org
You just looked this up. Could you explain it out loud?
That is the part interviews actually test. Tezvyn takes questions like this one and gives you what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles