JSON Web Encryption
JWE.
A standard (RFC 7516) for representing encrypted content as a compact, URL-safe JSON object, the encryption counterpart to JWS.
JWE adds operational complexity (key management for encryption keys, separate from signing keys) for benefits that most deployments don't need. The right fit is high-security scenarios where the token must travel over untrusted intermediaries, or where the token holder should not see internal claims (rare in modern CIAM).
Common questions
When should I use JWE instead of JWS?
Is a JWT always signed?
Does HTTPS replace the need for JWE?