Authentication is one of the most common interview topics for backend engineers.
Yet most developers answer interview questions with one sentence.
"We use JWT."
That isn't an answer.
JWT is only one small piece of an authentication system.
Let's build the entire flow from scratch.
Step 1: Authentication vs Authorization
Interviewers almost always start here.
Although these terms sound similar, they solve completely different problems.
Authentication
Authentication answers one question.
Who are you?
For example, when you log into Spotify:
Email
Password
↓
Authentication ServerIf your credentials are correct, Spotify knows you're really you.
Authentication is complete.
Authorization
Now another question appears.
What are you allowed to do?
Example:
Admin
↓
Delete Users ✅
----------------
Normal User
↓
Delete Users ❌You're authenticated in both cases.
Only one user is authorized.
This distinction is asked surprisingly often.
Step 2: What Happens After Login?
Imagine you log into Netflix.
Surely Netflix doesn't ask for your password every time you open a movie.
Instead, something like this happens.
Client
↓
POST /login
↓
Authentication Service
↓
Verify Username
↓
Verify Password
↓
Issue Tokens
↓
Client Stores TokenEvery request afterwards simply sends the token.
GET /profile
Authorization: Bearer eyJhbGc...No password required.
Step 3: What Is A Token?
A token is simply proof that you've already logged in.
Think of entering an office building.
The security guard checks your identity once.
Then gives you an access badge.
You don't show your passport every time you enter a meeting room.
The badge proves you've already been verified.
A token works exactly the same way.
Step 4: JWT Explained
JWT stands for JSON Web Token.
Contrary to what many people believe...
JWT is not authentication.
JWT is simply a format.
A JWT contains three parts.
Header
.
Payload
.
SignatureExample:
eyJhbGciOiJIUzI1Ni...
.
eyJ1c2VySWQiOjEwMS...
.
x93jd92kd9...Step 5: Header
Contains metadata.
{
"alg":"HS256",
"typ":"JWT"
}Mostly tells the server how the token was signed.
Step 6: Payload
Contains claims.
{
"userId":101,
"email":"john@gmail.com",
"role":"ADMIN",
"exp":1719000000
}Notice something important.
There is no password.
The payload usually contains:
- User ID
- Roles
- Permissions
- Expiration
- Issued Time
Step 7: Can Users Read JWTs?
Interview Question.
Is JWT encrypted?
No.
JWT is encoded, not encrypted.
Anyone can decode it.
Base64URL Decode
↓
Read PayloadThe important part is...
They cannot modify it.
Why?
Because of the signature.
Step 8: Signature
The signature proves nobody changed the payload.
HMACSHA256(
Header +
Payload +
Secret Key
)Suppose someone changes
Role
USER
↓
ADMINThe signature immediately becomes invalid.
The request gets rejected.
This is why JWTs are trusted.
Step 9: Common JWT Claims
Interviewers sometimes ask about these.
sub
Subject (User)
exp
Expiration
iat
Issued At
iss
Issuer
aud
Audience
jti
Unique Token IDYou don't need to memorize all of them.
Just understand what they're used for.
Step 10: Stateless Authentication
This is where interviews become interesting.
Traditional Session Authentication works like this.
Login
↓
Create Session
↓
Database
↓
Session123
↓
User101Every request requires looking up the session.
JWT works differently.
JWT
↓
Verify Signature
↓
Extract User
↓
ContinueThe server remembers nothing.
Everything needed already exists inside the token.
That's why JWT Authentication is called Stateless Authentication.
Why Is Stateless Better?
Imagine 5 million active users.
Sessions require storing millions of session objects.
JWTs don't.
Every request carries its own identity.
This makes authentication incredibly scalable.
But Stateless Has A Problem...
Suppose your JWT expires in 15 minutes.
After 2 minutes...
Your laptop gets stolen.
The attacker now has your JWT.
How do you invalidate it?
If the server never stored it...
How can it destroy it?
This question has confused countless backend engineers.
We'll answer it in Part 2, where we'll cover:
- Access Tokens
- Refresh Tokens
- Cookies vs Sessions vs JWT
- OAuth2 (Google Login)
- Logout
- JWT Revocation
- Redis Blacklists
- Refresh Token Rotation
- Production Authentication Best Practices
Interview Cheat Sheet
✅ Authentication = Who are you?
✅ Authorization = What can you access?
✅ JWT is a token format, not authentication.
✅ JWT payload is encoded, not encrypted.
✅ JWTs are signed to prevent tampering.
✅ Stateless means the server doesn't need to store session information for every authenticated user.
In the next part, we'll answer the question almost every interviewer asks:
"If JWTs are stateless, how do you log users out?"