Keys and Certificates
Online JWE Decoder, Encryptor and Decryptor
Inspect JSON Web Encryption compact tokens and work with their protected header, encrypted key, initialization vector, ciphertext and authentication tag. The tool supports debugging encrypted tokens with compatible PEM keys, JWK data and selected PFX/P12 containers.
JWE protects confidentiality, while JWS and signed JWT workflows focus on integrity and authenticity. Successful decryption requires a key and algorithms compatible with the token header.
Instructions
How to decode a JWE token
Paste the compact token into the JWE box on the left. The five parts are split and color-coded immediately, and the protected header is decoded as JSON in the field on the right. The encrypted key, initialization vector, ciphertext and authentication tag stay encoded because they can only be read after a successful decryption. Use Load example to fill the screen with a working token when you just want to explore the format.
How to decrypt a token
Load the matching key in the Keys and Certificates section: paste a PEM private key or a JWK into the private key box, or use Load private key to read it from a file. For PKCS#12 containers, click Load PFX / P12, type the password and click Extract Keys — the certificate and its private key are filled in automatically. With a compatible key loaded, the Decrypt button becomes available and the plaintext replaces the ciphertext field, which turns green when decryption succeeds.
How to encrypt a payload
Write the content you want to protect in the ciphertext field, adjust the alg and enc values in the protected header and load a public key (PEM certificate, PEM public key or JWK). Click Encrypt to build a new compact token, which appears fully assembled in the JWE box ready to be copied.
Editing the individual parts
Every part of the token is editable. Changing the decoded protected header, the encrypted key, the IV, the ciphertext or the authentication tag rebuilds the compact token on the left, and editing the token on the left splits it back into the individual fields. This makes it easy to inspect how each segment contributes to the final string.
Privacy
Parsing, encryption and decryption run entirely in your browser through the WebCrypto API and the JOSE library. Tokens, keys and passwords are never uploaded, so you can safely inspect production material — although rotating any key you paste into a shared machine is always good practice.
JWE Compact Serialization
A compact JWE has five parts separated by dots: Protected Header, Encrypted Key, Initialization Vector, Ciphertext and Authentication Tag. The header can be decoded as JSON; the other parts remain encoded because they depend on the keys and algorithm used for encryption.
Encryption and decryption use algorithms supported by the WebCrypto API through the JOSE library. The header defines the alg and enc combination; for PEM public/private keys, the most common flows are RSA-OAEP and ECDH-ES. Symmetric algorithms such as dir, AES-KW, AES-GCM-KW and PBES2 depend on a compatible secret/JWK.