Compact JWE Envelope Inspector

How to use Compact JWE Envelope Inspector

Inspect an encrypted JWE envelope, its untrusted protected header and the exact byte lengths of all five segments. Decode only the public header and structural segments, derive the compact serialization AAD bytes, and check selected AES-GCM/CBC-HMAC length profiles. Ciphertext and authentication tags remain unverified.

1. Provide compact jwe.
2. Choose the supported mode and run the tool. Review its assumptions and any reported errors.
3. Copy the result or download a separate output; reset to clear the current form.

Good to know

• 200 KB of compact ASCII text and at most 20 KB of decoded protected-header JSON. Canonical unpadded Base64url is required. Duplicate decoded JSON member names and prototype-related keys are refused.
• The tool never requests a decryption key, decrypts content, verifies a tag, follows jku/x5u URLs or decompresses zip content. All header values are untrusted claims.
• Length diagnostics cover the built-in RFC 7518 AES-GCM and AES-CBC-HMAC profiles and selected direct/wrapping key-management rules. Unknown algorithms and critical extensions are not accepted or interpreted.
• The example is a local structural fixture, not a credential or secure production encryption recipe. Matching lengths cannot prove authenticated encryption.
• Inputs are processed on this device and are not automatically saved or uploaded.