The JWT Interview Question Bank


jwt security interviews backend

The JWT Interview
Question Bank

A tiered framework of 20 questions that reveal how deeply a candidate truly understands JSON Web Tokens - from first principles to distributed systems design.

{/* ─── Level 1 ─── */}

  • 1.What is a JWT and what problem does it solve?
  • 2.What are the 3 parts of a JWT? What does each contain?
  • 3.Is the JWT payload encrypted? Can anyone read it?
  • 4.What is the difference between authentication and authorization - where does JWT fit?
Red flag
Can't explain the 3 parts of a JWT

{/* ─── Level 2 ─── */}

  • 1.How do you validate a JWT on the server side?
  • 2.What claims do you always check after verifying a JWT? (looking for: exp, iss, aud)
  • 3.Where do you store JWTs on the client side - and what are the tradeoffs? (localStorage vs httpOnly cookie)
  • 4.What happens if a JWT is stolen? How do you handle token revocation?
Red flag
Never checks exp or aud after verification

{/* ─── Level 3 ─── */}

  • 1.What is the alg: none vulnerability? How do you prevent it?
  • 2.What is the difference between HS256 and RS256? When would you choose one over the other?
  • 3.What is a refresh token and why is it needed alongside a short-lived access token?
  • 4.How would you implement token rotation with refresh tokens?
Red flag
Doesn't know the alg: none attack vector

{/* ─── Level 4 ─── */}

  • 1.How does JWKS work and why is it useful in distributed systems?
  • 2.What is kid and why does it matter during key rotation?
  • 3.How would you do zero-downtime key rotation in a microservices architecture?
  • 4.What is JWE vs JWT - when would you encrypt the payload?
Red flag
Has never heard of JWKS

{/* ─── Level 5 ─── */}

  • 1.Design a JWT-based auth system for 10 microservices. Walk me through every component.
  • 2.How would you handle a scenario where a private key is compromised mid-rotation?
  • 3.What are the tradeoffs between JWT-based auth vs opaque tokens + token introspection?
  • 4.If a high-traffic service is verifying thousands of JWTs per second, what bottlenecks would you anticipate and how would you address them?
Red flag
Can't reason about tradeoffs or design decisions

{/* ─── How to use ─── */}

How to use this guide
Start at Level 1 regardless of their experience - how they explain basics reveals clarity of thought.
Go deeper only if they answer confidently. Never skip ahead.
A strong candidate will naturally connect answers across levels - e.g., when asked about RS256, they'll mention JWKS without prompting.
Level 1
Can't name the 3 parts
Level 2
Never checks exp or aud
Level 3
Unaware of alg: none
Level 4
Never heard of JWKS
Level 5
Can't weigh tradeoffs

Built for engineering interviewers. Use as a calibration tool, not a checklist - the depth of explanation matters far more than the answer itself.

📐 Want to go deeper? Check out the full system design breakdown: Build JWT Auth System at Production Scale