# Why do I need a private key to verify a JWT? **URL:** \ **Category:** JWT.io\ **Tags:** jwt, rs256\ **Created:** [March 15, 2024, 4:49pm UTC](https://community.auth0.com/t/why-do-i-need-a-private-key-to-verify-a-jwt/129774 "2024-03-15T16:49:26Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![okneloper](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/okneloper/32/55664_2.png) [@okneloper](https://community.auth0.com/u/okneloper)\ **Post date:** [March 15, 2024, 4:49pm UTC](https://community.auth0.com/t/why-do-i-need-a-private-key-to-verify-a-jwt/129774/1 "2024-03-15T16:49:26Z")
Just looked at the video here [RS256 vs HS256 What's the difference?](https://auth0.com/blog/rs256-vs-hs256-whats-the-difference/) and it says that for RS256 algorythm a private key is used to create a JWT signature and a public key is used to veirfy the signature. This makes total sense. Why does [jwt.io](http://jwt.io) ask for my private key to verify the signature? If I need to share the private key, then this is no different from HS256 where the same key is used to both create and verify the signature? ---
**Author:** ![okneloper](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/okneloper/32/55664_2.png) [@okneloper](https://community.auth0.com/u/okneloper)\ **Post date:** [March 15, 2024, 7:02pm UTC](https://community.auth0.com/t/why-do-i-need-a-private-key-to-verify-a-jwt/129774/2 "2024-03-15T19:02:00Z")
Ok, it looks like I actually can verify a token with just the public key (which was my main concern), but still curious why [jwt.io](http://jwt.io) requires a private key. This is pretty confusing. ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [March 16, 2024, 1:03am UTC](https://community.auth0.com/t/why-do-i-need-a-private-key-to-verify-a-jwt/129774/4 "2024-03-16T01:03:15Z")
Hey there @okneloper ! > [@okneloper](#): > > Ok, it looks like I actually can verify a token with just the public key (which was my main concern), but still curious why [jwt.io](http://jwt.io) requires a private key. This is pretty confusing. Thanks for following up on this - I agree the language there is a bit confusing 🤔 FWIW if you are using RS256 [jwt.io](http://jwt.io) should automatically verify the signature for you without having to paste in your public key at all. It does this by using the issuer `iss` claim to call the [jwks endpoint](https://auth0.com/docs/secure/tokens/json-web-tokens/json-web-key-sets) and use the public key from there. ![Screenshot 2024-03-15 at 6.03.02 PM](https://global.discourse-cdn.com/auth0/original/3X/c/3/c3685add19b6c137aa756302f196321c92ab882f.png) ---
**Author:** ![okneloper](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/okneloper/32/55664_2.png) [@okneloper](https://community.auth0.com/u/okneloper)\ **Post date:** [March 16, 2024, 8:27pm UTC](https://community.auth0.com/t/why-do-i-need-a-private-key-to-verify-a-jwt/129774/5 "2024-03-16T20:27:45Z")
Thanks. I was testing my own token (signed by Laravel Passport) on [jwt.io](http://jwt.io). Just tried again, and got “Signature Verified” with just the public key. I presume you fixed it 🙂 thanks P.S. when I said > [@okneloper](#): > > I actually can verify a token with just the public key I meant in my application. [jwt.io](http://jwt.io) wouldn’t let me do that yesterday. ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [March 18, 2024, 4:14pm UTC](https://community.auth0.com/t/why-do-i-need-a-private-key-to-verify-a-jwt/129774/6 "2024-03-18T16:14:49Z")
Thanks for following up and clarifying! ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [April 1, 2024, 4:15pm UTC](https://community.auth0.com/t/why-do-i-need-a-private-key-to-verify-a-jwt/129774/7 "2024-04-01T16:15:04Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.