JWT RS256 Verifier

Check alg=RS256 with Web Crypto while keeping issuer/audience/key-discovery/application-policy validation separate.

Verify an RS256 JWT with Web Crypto

Paste a compact token and an SPKI PUBLIC KEY PEM. Verification checks only the RSASSA-PKCS1-v1_5/SHA-256 signature and the token's alg=RS256 header.

JWTSPKI public key PEM

—Signature

—alg

—exp

—Claims

A matching signature does not by itself validate issuer, audience, key provenance, revocation, nonce/state, authorization, or your application's accepted algorithms.

Trust and standards boundaries

Formatting is not schema validation, Base64 is not encryption, URL normalization is not a privacy guarantee, UUID metadata is not provenance, and decoded JWT claims are not trusted until cryptographic and application-specific validation succeeds. RS256 tools accept explicit PEM key formats and do not fetch issuer keys or make authorization decisions.