Five compact parts
01A compact JWE represents a protected header, encrypted key, IV, ciphertext, and authentication tag.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 3.1 ↗
RFC 7516 · § 3.1EXAMPLE
3 / 3
03
Authentication tag
Integrity must validate before plaintext is accepted.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
JWT carried in JWERFC 8725 § 3.3
The JWT BCP makes clear that every applicable cryptographic operation must validate, including both outer and inner operations for nested JWTs.
Read the updated RFC section ↗Compact JWE uses five period-separated parts.
- Compact JWE uses five period-separated parts.
- The protected header remains readable.
- The ciphertext hides the plaintext; base64url itself does not.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy