Verify an RS256 JWT with Web Crypto

Paste a compact token and an SPKI PUBLIC KEY PEM. Verification checks only the RSASSA-PKCS1-v1_5/SHA-256 signature and the token's alg=RS256 header.

JWT

SPKI public key PEM

—Signature

—alg

—exp

—Claims

A matching signature does not by itself validate issuer, audience, key provenance, revocation, nonce/state, authorization, or your application's accepted algorithms.

Local developer workflow

This v10.72 layer keeps high-frequency developer jobs browser-local and connects focused tools without replacing their established engines. JSON, Base64, URL, UUID and JWT content is processed in the browser; YAML may use the existing optional parser library when available, with its documented local fallback.

Trust and standards boundaries

Formatting is not schema validation, Base64 is not encryption, URL normalization is not a privacy guarantee, UUID metadata is not provenance, and decoded JWT claims are not trusted until cryptographic and application-specific validation succeeds. RS256 tools accept explicit PEM key formats and do not fetch issuer keys or make authorization decisions.

How to use this JWT RS256 Verifier

Verify RS256 JWT signatures locally using an SPKI PUBLIC KEY PEM with decoded claim status and a generated browser-only demo workflow.

Enter, paste, upload, or choose the inputs shown in the tool above.
Adjust the available options for the result you need.
Review the output before copying, downloading, or using it elsewhere.

What this tool does

Check alg=RS256 with Web Crypto while keeping issuer/audience/key-discovery/application-policy validation separate.

Practical tips and limits

Review the inputs and result before using the output elsewhere. Keep the original data when the operation changes or replaces content.