JWE Encryptor
Create and decrypt JWE tokens — RSA-OAEP, AES Key Wrap, AES-GCM Key Wrap, PBES2, ECDH-ES, and Direct
About JWE Encrypt & Decrypt Tool
The JWE (JSON Web Encryption) tool lets you encrypt and decrypt JWE tokens directly in your browser. JWE is a standard (RFC 7516) for securely transmitting encrypted data in a compact, URL-safe format. Use this tool to create encrypted tokens, test JWE implementations, decode tokens received from APIs, or learn about JSON Web Encryption structure and algorithms in a hands-on environment.
Understanding JWE Structure
A JWE token consists of five Base64URL-encoded parts separated by dots: the JOSE Header (specifying algorithms), the Encrypted Key (the content encryption key wrapped with the recipient's key), the Initialization Vector (random nonce), the Ciphertext (the encrypted payload), and the Authentication Tag (integrity verification). This structure ensures both confidentiality and integrity of the transmitted data, making JWE suitable for sensitive payloads in OAuth 2.0, OpenID Connect, and API security flows.
Key Features
- JWE encryption — encrypt plaintext into compact JWE tokens using standard key management and content encryption algorithms.
- JWE decryption — decrypt JWE tokens to reveal the original plaintext payload using the correct decryption key.
- Key management algorithms — supports RSA-OAEP, RSA-OAEP-256, A128KW, A256KW, dir, and other JWE key wrapping algorithms.
- Content encryption — AES-128-CBC-HS256, AES-256-CBC-HS512, A128GCM, A256GCM for payload encryption.
- Token inspection — view each JWE component: header, encrypted key, IV, ciphertext, and authentication tag.
- Client-side security — all operations use the Web Crypto API in your browser. No keys or data leave your device.
How to Use
- Select mode — choose Encrypt to create a JWE token or Decrypt to decode one.
- For encryption — enter the plaintext payload, provide the encryption key (symmetric or RSA public key), select algorithms, and click Encrypt.
- For decryption — paste the JWE token string, provide the decryption key (symmetric or RSA private key), and click Decrypt.
- Inspect results — view the decrypted payload or inspect individual token components for debugging.
JWE vs. JWS: When to Use Which
JWE provides confidentiality by encrypting the payload so only the intended recipient can read it. JWS (JSON Web Signature) provides integrity and authenticity by signing the payload so anyone can read it but no one can modify it undetected. Use JWE when the payload contains sensitive data (PII, credentials, financial data). Use JWS when you need to prove who created the token and that it hasn't been tampered with. In many systems, tokens are both signed (JWS) and then encrypted (JWE) for maximum security.
Real-World Use Cases
- Testing JWE token creation and decryption during OAuth 2.0 or OpenID Connect implementation.
- Debugging encrypted API tokens by decrypting and inspecting their payload contents.
- Creating encrypted test tokens for integration testing of microservices and API gateways.
- Learning about JWE structure, key management algorithms, and content encryption in a safe environment.
- Validating JWE implementations by comparing tool output with your application's encryption results.
Frequently Asked Questions
What is the difference between JWE and JWT?
JWT (JSON Web Token) is the umbrella term. A JWT can be either signed (JWS) or encrypted (JWE). JWE specifically provides confidentiality by encrypting the payload, while JWS only provides integrity through signing.
Is the encryption done in my browser?
Yes. All JWE operations are performed client-side using the Web Crypto API. No keys, tokens, or plaintext data are ever sent to any server.
Which algorithm should I choose?
For most use cases, use RSA-OAEP for key management and A256GCM for content encryption. This combination provides excellent security and broad compatibility across JWT libraries.
Can I use a symmetric key for JWE?
Yes. Use A128KW or A256KW for symmetric key wrapping, or "dir" to use the symmetric key directly as the content encryption key without wrapping.
What key format does the tool accept?
The tool accepts RSA keys in PEM format and symmetric keys as Base64-encoded strings. JWK (JSON Web Key) format is also supported for interoperability.