What is the difference between JWE and JWS?

JWS (JSON Web Signature) is a three-part signed token: header, payload, signature. Anyone can read the payload. JWE (JSON Web Encryption) is a five-part encrypted token: header, encrypted key, IV, ciphertext, tag. This page decrypts compact JWE only. If you need to inspect a signed JWT, use a JWS debugger — pasting three parts here will be rejected with an explanation, not treated as ciphertext.

Is this jwt token decrypt tool a jwt.io clone?

No. jwt.io is built around inspecting and verifying signed JWTs (JWS). This playground unwraps compact JWE. If you paste a three-part signed JWT it will be rejected with an explanation, not silently treated as encrypted. The FAKE example on the page is a labelled sample, not a production secret, and it never leaves the tab.

Does my key or token leave the browser?

No. Decryption uses the Web Crypto API in this page. Keys are kept in memory for the session of the tab — they are never written to localStorage, never posted to Page Utils, and never uploaded as a file to our servers. This page also stays ad-light: it does not include an advertisement slot. Close the tab to drop the material.

Which algorithms does JWT Token Decrypt support?

From the header, alg may be dir, A256KW, or RSA-OAEP. enc may be A128GCM or A256GCM. Other JOSE algorithms — signed JWS algs, A128CBC-HS256, RSA-OAEP-256 as a distinct alg, and so on — are rejected with a clear error rather than guessed. Match the key type to the header; the error text sits next to the field when the token or key is the problem.

Why must the token have five parts?

Compact JWE serialisation is five base64url segments. Compact JWS is three. If we accepted three parts we would be a signature debugger, which this page is not. Direct encryption still has five segments; the encrypted-key part is simply empty, so you will see two dots in a row. Count the dots before you paste if a token looks short.

What key formats can I paste?

For dir and A256KW: a UTF-8 string of the right length, hex, standard base64, or base64url. A256GCM needs 32 bytes, A128GCM needs 16, A256KW needs a 32-byte wrapping key. For RSA-OAEP: a PKCS#8 PEM block (BEGIN PRIVATE KEY). PKCS#1 (BEGIN RSA PRIVATE KEY) is not imported. Helper text under the key field repeats this so you do not have to hunt the FAQ mid-paste.

What if the plaintext is JSON?

If the bytes decode as UTF-8 JSON, the tool pretty-prints the object so you can read claims locally. Non-JSON payloads are shown as text. Nothing is sent to an inspector API. Use Copy plaintext when you want the formatted JSON on the clipboard; the success state confirms the decrypt happened in this browser.

JWT Token Decrypt

JWT Token Decrypt unwraps a compact JWE — a five-part encrypted token — in your browser with the Web Crypto API. It is not a JWS / signed-JWT debugger: three-part tokens are rejected. Keys and ciphertext stay in this tab and are never uploaded.

Compact JWE looks like header.encrypted_key.iv.ciphertext.tag. Direct encryption (alg: dir) still has five segments; the encrypted-key part is empty. Paste the matching key — raw, hex, or base64 for dir and A256KW, or a PKCS#8 PEM private key for RSA-OAEP — then decrypt. Supported enc values are A128GCM and A256GCM. Signed JWTs (JWS: header.payload.signature) belong in a signature debugger, not on this page. Close the tab to drop the key.

How does the JWT Token Decrypt work?

1. Paste a five-part JWE
Compact JWE is five base64url segments: header.encrypted_key.iv.ciphertext.tag. Direct (dir) tokens still have five parts; the encrypted-key segment is empty. Three-part values are signed JWS, which this page refuses — it decrypts JWE, it does not verify signatures.
2. Paste the matching key
Use a raw, hex, or base64 symmetric key for dir and A256KW, or a PKCS#8 PEM private key for RSA-OAEP. Nothing is stored in localStorage or uploaded. A labelled FAKE example is available if you want to try the flow first.
3. Decrypt in the browser
The page reads alg and enc from the protected header. Supported algs are dir, A256KW, and RSA-OAEP; enc is A128GCM or A256GCM. AES-GCM runs on-device with the JWE additional authenticated data. Press Decrypt, or submit the form from the primary button. Nothing is posted to Page Utils.
4. Copy header or plaintext
Plaintext is rendered here; JSON is pretty-printed when the bytes decode as UTF-8 JSON. Copy what you need, then close the tab to drop the key.

Questions about JWT Token Decrypt

What is the difference between JWE and JWS?: JWS (JSON Web Signature) is a three-part signed token: header, payload, signature. Anyone can read the payload. JWE (JSON Web Encryption) is a five-part encrypted token: header, encrypted key, IV, ciphertext, tag. This page decrypts compact JWE only. If you need to inspect a signed JWT, use a JWS debugger — pasting three parts here will be rejected with an explanation, not treated as ciphertext.
Is this jwt token decrypt tool a jwt.io clone?: No. jwt.io is built around inspecting and verifying signed JWTs (JWS). This playground unwraps compact JWE. If you paste a three-part signed JWT it will be rejected with an explanation, not silently treated as encrypted. The FAKE example on the page is a labelled sample, not a production secret, and it never leaves the tab.
Does my key or token leave the browser?: No. Decryption uses the Web Crypto API in this page. Keys are kept in memory for the session of the tab — they are never written to localStorage, never posted to Page Utils, and never uploaded as a file to our servers. This page also stays ad-light: it does not include an advertisement slot. Close the tab to drop the material.
Which algorithms does JWT Token Decrypt support?: From the header, alg may be dir, A256KW, or RSA-OAEP. enc may be A128GCM or A256GCM. Other JOSE algorithms — signed JWS algs, A128CBC-HS256, RSA-OAEP-256 as a distinct alg, and so on — are rejected with a clear error rather than guessed. Match the key type to the header; the error text sits next to the field when the token or key is the problem.
Why must the token have five parts?: Compact JWE serialisation is five base64url segments. Compact JWS is three. If we accepted three parts we would be a signature debugger, which this page is not. Direct encryption still has five segments; the encrypted-key part is simply empty, so you will see two dots in a row. Count the dots before you paste if a token looks short.
What key formats can I paste?: For dir and A256KW: a UTF-8 string of the right length, hex, standard base64, or base64url. A256GCM needs 32 bytes, A128GCM needs 16, A256KW needs a 32-byte wrapping key. For RSA-OAEP: a PKCS#8 PEM block (BEGIN PRIVATE KEY). PKCS#1 (BEGIN RSA PRIVATE KEY) is not imported. Helper text under the key field repeats this so you do not have to hunt the FAQ mid-paste.
What if the plaintext is JSON?: If the bytes decode as UTF-8 JSON, the tool pretty-prints the object so you can read claims locally. Non-JSON payloads are shown as text. Nothing is sent to an inspector API. Use Copy plaintext when you want the formatted JSON on the clipboard; the success state confirms the decrypt happened in this browser.

These tools run in your browser. Page Utils does not store, upload, or write to localStorage the keys, tokens, or text you paste. Results are a convenience aid, not legal, tax, or security advice.

JWT Token Decrypt

How does the JWT Token Decrypt work?

Questions about JWT Token Decrypt

What else can I open?