Encrypting JWT payload

Question

JWTs have 3 parts:

1. HEADER:ALGORITHM & TOKEN TYPE
2. PAYLOAD:DATA
3. SIGNATURE TO BE VERIFIED WITH THE SECRET KEY

Is it possible to

Answer 1

In fact there is not only signed JWT, but several technologies described by RFCs:

• JWS JSON Web Signature (RFC 7515),
• JWT JSON Web Token (RFC 7519),
• JWE JSON Web Encryption (RFC 7516),
• JWA JSON Web Algorithms (RFC 7518).
• JWK JSON Web Key (RFC 7517).

In your case, read the RFC7516 (JWE). These JWE have 5 parts:

• Protected Header
• Encrypted Key
• Initialization Vector
• Ciphertext
• Authentication Tag

Depending on your platform, you may find a library that will help you to create such encrypted JWT. Concerning PHP, I am writting a library that is already able to load and create these jose.