If you’ve heard terms like JWT Token, Bearer Token, or JSON Web Token and felt confused, don’t worry — in the next 2 minutes, you’ll clearly understand what it is, why it’s used, and how it works.
What is JWT Token?
A JWT (JSON Web Token) is a small, safe way to send information between two systems (like client and server) as a digitally signed string.
Think of it like a sealed envelope:
- It contains information (claims).
- It’s sealed with a signature so no one can tamper with it.
- Only the trusted sender and receiver know the secret.
JWTs are commonly used for authentication (logging into apps) and authorization (checking what you’re allowed to do).
Internal of JWT Token
A JWT Token has 3 parts separated by dots (.):
xxxxx.yyyyy.zzzzz
- Header → Contains info about the type of token and algorithm used (like HS256).
- Payload → The actual data/claims (like user id, role, or expiration time).
- Signature → A cryptographic seal that ensures the data hasn’t been changed.
👉 Example (simplified):
Header: { "alg": "HS256", "typ": "JWT" }
Payload: { "id": 101, "role": "admin", "exp": 1700000000 }
Signature: <generated using secret>
When combined and encoded, you get a JWT Token string that looks like random characters.
Why is JWT Token Important?
- Stateless → No need to store session in server memory.
- Secure → Data can be verified with a secret or public/private key.
- Portable → Works across APIs, microservices, and mobile apps.
This is why JWT Tokens are a favorite for modern authentication systems in .NET, Java, Python, Node.js, and beyond.
Common JWT Token Interview Questions
1. What is the difference between JWT and a Session?
- Session: Data is stored on the server.
- JWT: Data is stored inside the token itself, client-side, and validated on each request.
2. Can JWT Token be hacked if someone steals it?
Yes! If an attacker steals the token, they can use it until it expires. That’s why best practices include short expiry times and refresh tokens.
Bonus: Continuation in Coroutine Interview Questions
Since JWT often comes up in async programming and API calls, interviewers may jump to coroutines. Here are two common questions:
Q1. What is the difference between suspend function and coroutine in Kotlin?
- A
suspendfunction is just a function that can be paused and resumed without blocking a thread. - A coroutine is the actual lightweight task or unit of work that runs such functions.
👉 Think ofsuspendas capability, and coroutine as the runner that uses it.
Q2. What happens if we don’t handle cancellation in a coroutine?
If you ignore cancellation, the coroutine may keep running even when the user navigates away or closes the app. This wastes memory, CPU, and network.
- Proper handling ensures cleanup (like closing DB connections or stopping API calls).
👉 Always useisActiveorwithContext(NonCancellable)wisely for safe resource cleanup.
✅ In short: JWT Token = Safe, stateless way to carry authentication data, and understanding coroutines helps you build efficient, scalable APIs.
