Practical guide
JWE vs JWT: Why Some Tokens Have Five Parts
Many developers expect a token to have three parts because signed JWTs are common. Encrypted JWE compact tokens are different: they normally have five parts and hide the payload from simple decoding.
Open the free toolStep-by-step
- Count the dot-separated sections in the token.
- Three parts usually indicate a signed JWT or JWS compact token.
- Five parts usually indicate a JWE compact token.
- Use the JWT decoder for readable three-part tokens.
- Use the JWE parser to inspect the protected header of five-part tokens.
- Do not expect a JWE parser to reveal the encrypted payload without the correct key.
Important tips
- JWT is a token claims format; JWS signs content; JWE encrypts content.
- A JWE protected header can reveal alg, enc, kid, or zip, but not the encrypted claims.
- If your application expects JWT but receives JWE, check identity-provider encryption settings.
- Never disable token verification just because a token is hard to inspect.
Frequently asked questions
Why does my token have five parts?
It is likely a compact JWE, which has protected header, encrypted key, IV, ciphertext, and authentication tag.
Can I decode a JWE like a JWT?
You can inspect the protected header, but the payload is encrypted and needs the correct key to decrypt.
Is JWE more secure than JWT?
It solves a different problem. JWE hides content; JWS proves integrity. Many systems use signed JWTs, encrypted JWEs, or nested combinations depending on requirements.