JOSE-JWE-ENC(1)

💖 jose-jwe-enc(1) 💖

okay so bestie, welcome to jose-jwe-enc — the jose manual page that's gonna teach you how to lock your secrets in a cryptographic vault 🔐✨

✨ NAME ✨

jose-jwe-enc — encrypts plaintext using one or more JWK/password 💅

🎀 SYNOPSIS 🎀

jose jwe enc [-i JWE] -I PT -k JWK [-p] [-r RCP] [-o JWE] [-O CT] [-c]

🦋 OVERVIEW 🦋

So the jose jwe enc command encrypts your data using one or more JWK (-k) or a password (-p). And here's the slay part: when you give it more than one JWK or password, decryption will succeed with any one of the provided keys — so every recipient gets in with their own key, no sharing required. iconic behavior, honestly 👑

You can also make a detached JWE by specifying the -O option. In that case the decoded ciphertext gets written to the output you specified and it is not included in the JWE. detached, mysterious, main character energy 🕵️‍♀️

And if you're only using one key (-k or -p), the resulting JWE may be output in JWE Compact Serialization by using the -c option. short, sweet, compact 🎀

---

okay now the fun part — this command uses a template based approach for constructing a JWE. you can specify templates of the JWE itself (-i) or for the JWE Recipient Object (-r). attributes specified in either of these templates will appear unmodified in the output. the one exception? the JWE Protected Header should be specified in its decoded form in the template — this command will automatically encode it as part of the encryption process. don't worry about it, it's handled 💅

If you specify a JOSE Header Parameter (via either the -i or -r options) that affects the construction of the JWE, this command will attempt to behave according to that parameter as if it were configuration. for example, specifying the "zip" parameter in the JWE Protected Header will cause the plaintext to be compressed before encryption. currently, jose will modify its behavior for the "alg", "enc" and "zip" JOSE Header Parameters (see RFC 7516 Section 4.1.3), as well as the algorithm-specific parameters for the algorithms we support (see RFC 7518 Section 4). no cap, it just knows 🧚

That said — it is not necessary to provide any templates! jose jwe enc will automatically fill in the "alg" and "enc" parameters by inferring the correct algorithms from the provided input keys (JWK or password). so like, the -i and -r options should generally be used for providing extended JWE metadata. optional, but cute 🫶

💜 OPTIONS 💜

• -i JSON, --input=JSON — parse JWE from JSON 🌸
• -i FILE, --input=FILE — read JWE from FILE 🎀
• -i -, --input=- — read JWE from standard input 💫
• -I FILE, --detached=FILE — read decoded ciphertext from FILE 🦋
• -I -, --detached=- — read decoded ciphertext from standard input ✨
• -r FILE, --recipient=FILE — read JWE recipient template from FILE 💌
• -r -, --recipient=- — read JWE recipient template from standard input 📥
• -k FILE, --key=FILE — read JWK(Set) from FILE 🔑
• -k -, --key=- — read JWK(Set) from standard input 🗝️
• -p, --password — prompt for an encryption password 🤫
• -o FILE, --output=FILE — write JWE to FILE 📝
• -o -, --output=- — write JWE to stdout (default) 🖥️
• -O FILE, --detach=FILE — detach ciphertext and decode to FILE ✂️
• -O -, --detach=- — detach ciphertext and decode to standard output 📤
• -c, --compact — output JWE using compact serialization 🎁

🔥 EXAMPLES 🔥

Encrypt data with a symmetric key using JWE JSON Serialization:

$ jose jwk gen -i '{"alg":"A128GCM"}' -o key.jwk
$ jose jwe enc -I msg.txt -k key.jwk -o msg.jwe

Encrypt data with a password using JWE Compact Serialization:

$ jose jwe enc -I msg.txt -p -c -o msg.jwe
Please enter an encryption password:
Please re-enter the previous password:

Compress plaintext before encryption:

$ jose jwe enc -i '{"protected":{"zip":"DEF"}}' ...

Encrypt with two keys and two passwords:

$ jose jwk gen -i '{"alg":"ECDH-ES+A128KW"}' -o ec.jwk
$ jose jwk gen -i '{"alg":"RSA1_5"}' -o rsa.jwk
$ jose jwe enc -I msg.txt -p -k ec.jwk -p -k rsa.jwk -o msg.jwe
Please enter a password:
Please re-enter the previous password:
Please enter a password:
Please re-enter the previous password:

👑 AUTHOR 👑

Nathaniel McCallum <npmccallum@redhat.com> — the legend who made this happen, we stan 🫶

🌈 SEE ALSO 🌈

jose-jwe-dec(1), jose-jwe-fmt(1) — go read these next, bestie, they're literally the siblings of this page 💖

---

and that's the whole page! this little beauty comes to you from the JOSE-JWE-ENC(1) source, dated 06/09/2026 — write it in your notes, put it on your fridge, tattoo it on your arm, whatever works 🎀✨💅