JWE vs JWS
What this is
JWS (3 parts) is signed and readable. JWE (5 parts) is encrypted: protected header, encrypted key, IV, ciphertext, tag. Use JWE when the payload itself is sensitive to intermediaries. Most 'JWTs' in OAuth are JWS. If you pasted five dots-worth of segments, you need the recipient key to decrypt — not this page.
FAQ
- Is JWE more secure than JWS?
- It hides claims in transit. It does not replace audience checks, short exp, or TLS. Signed-then-encrypted is the usual order.