← Microsoft Interview Insights

Microsoft·Software Engineer·Technical Phone Screen·Intermediate

Intermediate
Jun 2026

Summary

Microsoft coding screen focused on low-level string parsing, specifically writing a JWT decoder from scratch without any libraries. Pretty niche problem that made me realize how much I lean on tooling I've never actually looked inside.

Questions Asked (1)

Q1

Write a function that decodes a JWT token by manually Base64URL-decoding the header and payload portions and parsing each as JSON, without using any JWT library.

Algorithms & Data StructuresTechnical Trade-offsAPI & Integrations
Author's notes

First thing I did was ask whether libraries were fair game, which felt awkward but turned out to be the right call because the whole point was to do it manually.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying that a JWT consists of three Base64URL-encoded parts separated by dots, and that we only need to decode the header and payload. Then outline a function that splits the token, applies Base64URL decoding (handling padding and character replacements), and parses each part as JSON. Emphasize that this is for decoding only, not signature verification, and discuss trade-offs like error handling and security implications.

Pro tip: Mention that Base64URL uses '-' and '_' instead of '+' and '/', and that padding may be omitted—so you need to add '=' padding before decoding. Also note that you should never trust the decoded payload without verifying the signature, which is a common security pitfall.

1. Understand JWT structure

Explain that a JWT has three parts: header, payload, and signature, separated by dots. Only the first two are Base64URL-encoded JSON.

2. Split and decode Base64URL

Split the token by '.', take the first two parts, and decode each from Base64URL to a UTF-8 string. Handle padding and character replacements.

3. Parse JSON

Parse the decoded strings as JSON objects using the language's JSON parser, with error handling for invalid input.

4. Return decoded objects

Return the header and payload as objects (e.g., a dictionary or struct) for further use.

5. Discuss security and trade-offs

Highlight that this does not verify the signature, so it should only be used for non-security-critical decoding. Mention error handling and edge cases.

Key Points to Mention

  • Base64URL encoding differences: '-' and '_' instead of '+' and '/', and optional padding.
  • JWT structure: header.payload.signature, with header and payload being JSON.
  • Decoding process: split, Base64URL-decode, parse JSON.
  • Security warning: decoding without signature verification is insecure for authentication.
  • Error handling: invalid token format, invalid Base64URL, invalid JSON.
  • Trade-offs: using a library vs. manual decoding (control, dependencies, security).

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.