Skip to content
jwecodec

JWE Decoder

Paste an encrypted token to read its header and see what each of its five parts holds. Enter the recipient's private key, the shared key or the password to decrypt the contents. Nested JWTs (signed, then encrypted) are unpacked too.

Runs 100% in your browser — nothing is uploaded

Encrypted token (JWE)

309 charsAES-256 Key WrapAES-256-GCM

Structure

  • Protected header44 bytesJSON, authenticated as AAD
  • Encrypted key40 bytesCEK wrapped with AES Key Wrap
  • Initialization vector12 bytesrandom, per token
  • Ciphertext115 bytessame length as the plaintext
  • Authentication tag16 bytesdetects any change

Protected header

{
  "alg": "A256KW",
  "enc": "A256GCM",
  "typ": "JWT"
}

Decrypt

A256KW needs exactly 32 bytes (256 bits).

Decrypting…