🔐 JSON Web Encryption (JWE) – Encrypt & Decrypt Payloads
The JSON Web Encryption (JWE) Tool lets you encrypt sensitive JSON payloads and decrypt JWE tokens entirely in your browser. Built on RFC 7516, JWE provides confidentiality — the payload is fully encrypted so only the party holding the correct key can read it. This is fundamentally different from JWS/JWT, which only signs data but leaves it readable by anyone.
What Is JWE and Why Use It?
While JWT (JSON Web Token) with JWS ensures integrity and authenticity, the payload is merely Base64URL-encoded — any observer can decode and read it. JWE closes this gap by encrypting the payload before embedding it in the token. Common use cases include:
- OIDC id_token encryption — OpenID Connect providers can deliver encrypted ID tokens so only your application can read user claims.
- Secure API payloads — encrypt PII (personally identifiable information) before including it in tokens passed through untrusted intermediaries.
- End-to-end encrypted messaging — JWE tokens carry encrypted messages between parties that each hold their own private key.
- Encrypted refresh tokens — protect long-lived tokens so their contents remain confidential even if intercepted.
JWE Token Structure
A compact JWE token has five dot-separated Base64URL-encoded parts:
JSON object with alg, enc, kid, and other header claims — Base64URL encoded
The Content Encryption Key (CEK), wrapped with the key management algorithm. Empty for dir mode.
Random IV/nonce used by the content encryption algorithm (12 bytes for GCM, 16 for CBC)
The encrypted payload produced by the content encryption algorithm
Integrity tag that proves the ciphertext and header have not been tampered with
The five parts are concatenated as: Header.EncryptedKey.IV.Ciphertext.Tag
Two-Level Encryption: alg and enc
JWE uses a two-level encryption design. Understanding both algorithm parameters is essential:
- alg (Key Management Algorithm) — determines how the Content Encryption Key (CEK) is protected. For RSA-OAEP, the CEK is encrypted with the recipient's RSA public key. For AES Key Wrap (A256KW), the CEK is wrapped with a shared symmetric secret. For
dir, no wrapping occurs — the shared key is the CEK directly. - enc (Content Encryption Algorithm) — the authenticated symmetric encryption algorithm applied to the actual payload. AES-GCM variants (
A128GCM,A256GCM) are preferred for new applications due to their built-in authentication. AES-CBC variants (A128CBC-HS256) combine AES encryption with HMAC for authentication.
Supported Algorithms
| alg | Type | Key Requirement |
|---|---|---|
RSA-OAEP | Asymmetric | RSA public key (≥2048-bit) to encrypt; private key to decrypt |
RSA-OAEP-256 | Asymmetric | RSA public key (≥2048-bit); SHA-256 hash |
A128KW / A256KW | Symmetric | 16 / 32 byte shared secret (Base64) |
A128GCMKW / A256GCMKW | Symmetric | 16 / 32 byte shared secret — GCM key wrapping |
dir | Direct | Raw CEK matching enc byte length requirement |
ECDH-ES | Asymmetric | EC public key (P-256/P-384/P-521) to encrypt; private key to decrypt |
ECDH-ES+A128KW / +A256KW | Asymmetric | EC key pair — ECDH-derived key wraps CEK |
Key Format Guide
This tool accepts keys in the following formats:
- PEM (RSA / EC) — paste the key between
-----BEGIN PUBLIC KEY-----and-----END PUBLIC KEY-----markers. For decryption, use-----BEGIN PRIVATE KEY-----(PKCS#8) or-----BEGIN RSA PRIVATE KEY-----(PKCS#1). - JWK JSON — paste the full JWK object, e.g.
{"kty":"RSA","n":"...","e":"AQAB"}. The tool auto-detects JWK vs PEM by checking if the input starts with{. - Base64 (Symmetric) — for AES-KW and
diralgorithms, provide the raw key bytes encoded as standard or URL-safe Base64.
Security Considerations
- All cryptographic operations run entirely in your browser via the WebCrypto API. No keys or plaintext are transmitted to any server.
- Prefer RSA-OAEP-256 + A256GCM or ECDH-ES + A256GCM for new applications — these provide the strongest security posture.
- The authentication tag guarantees both confidentiality and integrity. If the token is tampered with or the wrong key is used, decryption will fail with an authentication error — never silently return garbage data.
- For dir mode, never reuse the same key with the same IV. Each encryption call generates a fresh random IV automatically.
- Avoid pasting production private keys into online tools. Use test key pairs for exploration and learning with this tool.
JWE vs JWS vs JWT: Quick Reference
| Standard | Purpose | Parts | Payload Readable? |
|---|---|---|---|
| JWT (via JWS) | Signed token — verify identity | 3 | Yes (Base64URL) |
| JWS | Sign any content for integrity/auth | 3 | Yes (Base64URL) |
| JWE | Encrypt payload for confidentiality | 5 | No (encrypted) |