JWT Structure Interview Questions and Answers

Top 10 JWT Structure interview questions with Mermaid diagrams, Header, Payload, Signature, Spring Security examples, and enterprise best practices.

JWT Structure - Interview Questions & Answers

A JWT (JSON Web Token) is a compact, URL-safe token used to securely exchange information between two parties. Understanding the internal structure of a JWT is one of the most common Spring Security interview topics.

A JWT consists of three Base64URL-encoded parts separated by dots (.):

Header.Payload.Signature

Q1. What is the structure of a JWT?

Answer

A JWT has three parts:

Header
Payload
Signature

These three sections are separated using dots (.).

JWT Structure

flowchart LR
A[JWT] --> B[Header] --> C[Payload] --> D[Signature]

Example

xxxxx.yyyyy.zzzzz

Where:

xxxxx → Header
yyyyy → Payload
zzzzz → Signature

Q2. What is the JWT Header?

Answer

The Header contains metadata about the JWT.

It tells the receiver:

Which signing algorithm is used.
Which token type is being used.

Example Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Header Diagram

flowchart TD
A[Header]

A --> B[Algorithm]

A --> C[Token Type]

B --> D[HS256 / RS256]

C --> E[JWT]

Common Header Fields

Field	Meaning
alg	Signing Algorithm
typ	Token Type

Q3. What is the JWT Payload?

Answer

The Payload stores Claims.

Claims are pieces of information about the authenticated user.

Example Payload

{
  "sub":"venu",
  "role":"ADMIN",
  "department":"Payments",
  "exp":1750000000
}

Payload Structure

flowchart TD
A[Payload]

A --> B[Subject]

A --> C[Role]

A --> D[Expiration]

A --> E[Custom Claims]

Types of Claims

Registered Claims
Public Claims
Private Claims

Q4. What is the JWT Signature?

Answer

The Signature protects the JWT from tampering.

It is created by signing:

Header
Payload
Secret Key (HS256)

Private Key (RS256)

Signature Generation

flowchart LR
A[Header] --> D[Signature Generator]

B[Payload] --> D

C[Secret Key] --> D

D --> E[JWT Signature]

Purpose

Verify integrity
Detect tampering
Validate token authenticity

Q5. How is a JWT generated?

Answer

JWT generation consists of three steps.

JWT Creation Flow

flowchart TD
A[Header] --> D[Base64URL Encode]

B[Payload] --> E[Base64URL Encode]

D --> F[Sign]

E --> F

C[Secret/Private Key] --> F

F --> G[JWT Token]

Steps

Create Header.
Create Payload.
Generate Signature.
Combine all three sections.

Q6. What are Registered Claims?

Answer

Registered Claims are predefined claim names defined by RFC 7519.

Claim	Description
sub	Subject
iss	Issuer
aud	Audience
exp	Expiration Time
iat	Issued At
nbf	Not Before
jti	JWT ID

Registered Claims

flowchart TD
A[Registered Claims]

A --> B[sub]

A --> C[iss]

A --> D[exp]

A --> E[iat]

A --> F[aud]

Interview Tip

Use registered claims whenever possible for better interoperability.

Q7. What are Custom Claims?

Answer

Custom Claims store application-specific information.

Example:

{
  "username":"venu",
  "role":"ADMIN",
  "department":"Payments",
  "employeeId":"EMP1001"
}

Custom Claims

flowchart LR
A[Payload]

A --> B[Role]

A --> C[Department]

A --> D[Permissions]

A --> E[Employee ID]

Best Practice

Store only the information required by downstream services.

Q8. Why should sensitive information never be stored inside the Payload?

Answer

The Payload is Base64URL encoded, not encrypted.

Anyone possessing the JWT can decode and read the payload.

Payload Visibility

flowchart LR
A[JWT] --> B[Decode Base64URL] --> C[Readable Payload]

Never Store

Passwords
Credit Card Numbers
Aadhaar / SSN
API Keys
Secrets
OTPs

Safe Information

User ID
Username
Roles
Permissions
Token Expiration

Q9. How does Spring Security validate a JWT Signature?

Answer

Spring Security validates the signature before trusting the JWT.

Validation includes:

Signature Verification
Expiration Check
Issuer Validation
Audience Validation
Claims Validation

Validation Flow

flowchart TD
A[Incoming JWT] --> B[Decode Header] --> C[Verify Signature] --> D[Validate Claims] --> E[Authentication Success]

If validation fails, the request is rejected with 401 Unauthorized.

Q10. What are the enterprise best practices for JWT structure?

Answer

Follow these best practices:

Use strong signing algorithms (RS256 or ES256 for distributed systems; HS256 only when appropriate for symmetric-key use cases).
Keep the Payload small.
Never store sensitive data in the Payload.
Use registered claims.
Set short expiration times.
Validate issuer and audience.
Rotate signing keys.
Protect private keys using KMS or Vault.
Always use HTTPS.
Log token validation failures.

Enterprise JWT Architecture

flowchart TD
A[User] --> B[Authentication Server] --> C[Generate JWT] --> D[JWT Header] --> E[JWT Payload] --> F[JWT Signature] --> G[Client] --> H[Spring Security] --> I[Protected API]

Complete JWT Validation

flowchart LR
A[JWT] --> B[Decode] --> C[Validate Signature] --> D[Validate Claims] --> E[SecurityContext] --> F[Controller]

Senior Interview Tip

Interviewers expect you to know exactly what each JWT section does.

Remember:

Header → Metadata (algorithm, token type)
Payload → Claims (user information)
Signature → Integrity and authenticity

The Signature is the most important security component because it prevents attackers from modifying the Header or Payload without detection.

Quick Revision

JWT has three parts: Header, Payload, and Signature.
Header stores metadata.
Payload stores claims.
Signature verifies integrity.
Payload is encoded, not encrypted.
Never store sensitive information in the Payload.
Use registered claims whenever possible.
Validate the Signature before trusting the JWT.
Rotate signing keys regularly.
Use HTTPS and secure key management in production.