A JWT is made up of three dot-separated, Base64URL-encoded parts—header, payload, and signature—that together let a recipient verify who issued the token and what it claims, without needing to look anything up on the server.
Key Points: • The header specifies the token type (JWT) and the signing algorithm, such as HS256 or RS256. • The payload contains claims: standard ones like sub (subject), iat (issued at), and exp (expiration), plus custom claims like roles or user ID. • The signature is computed over the header and payload using a secret or private key, so any tampering invalidates it. • JWTs are encoded, not encrypted by default, so payload contents are readable by anyone—sensitive data shouldn't go in the claims unless the token is also encrypted (JWE). • The three parts are joined as header.payload.signature, separated by periods.
Example: A decoded JWT payload might look like {"sub": "jdoe", "roles": ["ADMIN"], "exp": 1728950400}, which a server verifies against the signature before trusting the claims.
Interview Tip: A concise interview answer is:
"A JWT has three parts: a header describing the algorithm and token type, a payload holding claims like the subject, roles, and expiration, and a signature that verifies the token hasn't been tampered with. It's important to remember the payload is just encoded, not encrypted, so nothing sensitive should go in it unprotected."