System Design Series — Part 28

Imagine you're shopping on Amazon.

You log in once.

Then you can:

• Browse products
• Add items to your cart
• Place an order
• Track deliveries
• View your profile

You never enter your password again while using the app.

Have you ever wondered:

How does the server know it's still you?

Does the server remember every logged-in user?

Not usually.

Instead, most modern applications use something called a JWT (JSON Web Token).

JWT is one of the most widely used authentication mechanisms in modern web applications, mobile apps, APIs, and microservices.

Let's understand it in the simplest way possible.

The Real Problem

Imagine you're building an online banking application.

A user logs in.

If the server asks for the username and password on every API request, the user experience would be terrible.

Instead, after the first successful login, the server needs a secure way to identify the user for future requests.

That's exactly what JWT solves.

A Simple Real-World Analogy

Imagine you check into a hotel.

At the reception:

You show your ID.

The receptionist verifies your identity.

Then you're given a room key card.

Now, whenever you enter your room,

you don't show your passport again.

You simply use the key card.

The key card proves you've already been verified.

JWT works exactly the same way.

The login process verifies your identity once.

The JWT acts like your digital key card for future requests.

What is JWT?

JWT stands for:

JSON Web Token

It is a secure token issued by the server after successful authentication.

Instead of sending your username and password with every request,

you simply send the JWT.

The server validates the token and processes your request.

This makes authentication fast and scalable.

How JWT Authentication Works

Step 1

User enters username and password.

↓

Step 2

Authentication Service verifies credentials.

↓

Step 3

Server generates a JWT.

↓

Step 4

JWT is returned to the client.

↓

Step 5

The client stores the token securely.

↓

Step 6

Every future request includes the JWT.

↓

Step 7

Server validates the token before processing the request.

No need to log in again until the token expires.

What's Inside a JWT?

A JWT consists of three parts.

Header

Contains information about the signing algorithm.

Payload

Contains user information such as:

• User ID
• Username
• Roles
• Token expiration

Remember:

Never store sensitive information like passwords inside a JWT.

Signature

A cryptographic signature generated by the server.

It ensures the token hasn't been modified.

If someone changes the payload,

the signature becomes invalid,

and the server rejects the request.

Real-World Example

Imagine you're using Netflix.

You log in once.

A JWT is generated.

Now every request—

• Play movie
• Continue watching
• Add to watchlist
• View recommendations

includes the JWT.

Netflix doesn't ask for your password every few seconds.

The token identifies you.

Another Example: Hospital Management System

A doctor logs in.

The JWT contains:

• Doctor ID
• Role = Doctor
• Expiration Time

When the doctor requests patient records,

the backend validates the token first.

Then it checks whether the doctor's role has permission to access that data.

Authentication and authorization work together.

Why JWT is Popular

JWT became popular because it supports stateless authentication.

The server doesn't need to store session information for every logged-in user.

Each request carries everything needed to identify the user.

This makes horizontal scaling much easier.

That's why JWT is commonly used in cloud-native and microservices architectures.

JWT in Production Architecture

A typical authentication flow looks like this:

User

↓

Load Balancer

↓

API Gateway

↓

Authentication Service

↓

JWT Generated

↓

Client

↓

Future Requests

↓

API Gateway

↓

JWT Validation

↓

Application Services

↓

Database

Notice that the user's password is only used during login.

Every other request relies on the JWT.

JWT vs Session Authentication

Session Authentication

• Server stores user sessions.
• More memory usage.
• Sticky sessions may be required in distributed systems.

JWT Authentication

• Server stores no session.
• Stateless.
• Easy to scale.
• Works well with load balancers and microservices.

This is one reason JWT is preferred in modern distributed systems.

Advantages of JWT

✔ Stateless authentication

✔ Scales easily

✔ Works well with REST APIs

✔ Supports microservices

✔ Reduces database lookups

✔ Ideal for mobile and SPA applications

✔ Easy to integrate with API Gateways

Challenges of JWT

Token Expiration

Tokens should expire after a reasonable period.

Never create tokens that never expire.

Token Revocation

Once a JWT is issued,

revoking it before expiration requires additional strategies such as token blacklists.

Secure Storage

Store JWTs securely.

Avoid exposing them to malicious scripts.

Short Expiration + Refresh Tokens

Many production systems use:

• Access Tokens (short-lived)
• Refresh Tokens (long-lived)

This improves security while maintaining a good user experience.

Common Developer Mistakes

Storing Sensitive Data Inside JWT

JWTs are encoded, not encrypted.

Never include passwords or confidential information.

Using Weak Signing Keys

Always use strong secret keys or public/private key pairs.

Ignoring Token Expiration

Expired tokens should never be accepted.

Skipping HTTPS

Always transmit JWTs over HTTPS.

Otherwise, attackers may intercept them.

Trusting the Client

The server must always validate the JWT before processing requests.

Never trust tokens without verification.

Production-Level Insight

A common misconception is:

"JWT is more secure than sessions."

Not necessarily.

JWT isn't automatically more secure.

Its biggest advantage is scalability.

Whether you use sessions or JWT depends on your application's requirements.

Large distributed systems often choose JWT because it works well with stateless architectures and load balancing.

Interview Tip

A common System Design interview question is:

"Why do modern applications prefer JWT authentication?"

A strong answer should mention:

• Stateless authentication
• Scalability
• Microservices
• Load balancing
• REST APIs
• Token validation
• Access Tokens and Refresh Tokens

Interviewers are looking for architectural understanding—not just the definition of JWT.

Key Takeaways

✔ JWT stands for JSON Web Token

✔ It allows users to authenticate once and reuse the token

✔ JWT supports stateless authentication

✔ Every request carries the token for identity verification

✔ JWT consists of Header, Payload, and Signature

✔ Never store sensitive data inside a JWT

✔ Use HTTPS, token expiration, and refresh tokens for better security

✔ JWT is widely used in modern APIs and microservices

One of the biggest lessons in System Design is this:

Authentication should be secure.

Authentication should also scale.

JWT helps modern applications achieve both when implemented correctly.

This is Part 28 of the System Design Simplified series.

Next Article: Part 29 — OAuth 2.0 Explained Simply

If this article helped you understand JWT Authentication better, consider sharing it with fellow developers.

#SystemDesign #JWT #Authentication #SoftwareArchitecture #BackendDevelopment #APISecurity #Microservices #RESTAPI #CloudComputing #SoftwareEngineering #SystemDesignInterview #BackendEngineer #OAuth #Programming #TechArchitecture