RS256
What this is
RS256 is RSASSA-PKCS1-v1_5 with SHA-256. The authorization server keeps the private key; APIs and SPAs verify with the JWKS public key. Auth0, Cognito, Okta, and Google ID tokens are usually RS256. OIDC id_token and access tokens consumed by multiple services.
Open the decoder and paste a RS256 token. Verification stays in the browser.
FAQ
- Where do I get the key?
- Issuer + /.well-known/openid-configuration → jwks_uri. Match the token header kid to a JWK. This tool can fetch JWKS in the browser if CORS allows, or you paste the JWK.
- Minimum key size?
- 2048-bit RSA is the floor. 1024-bit keys should be rejected.