# Why do I need a private key to verify a JWT?

**URL:** <https://community.auth0.com/t/why-do-i-need-a-private-key-to-verify-a-jwt/129774>\
**Category:** JWT.io\
**Tags:** jwt, rs256\
**Created:** [March 15, 2024, 4:49pm UTC](https://community.auth0.com/t/why-do-i-need-a-private-key-to-verify-a-jwt/129774 "2024-03-15T16:49:26Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [March 16, 2024, 1:03am UTC](https://community.auth0.com/t/why-do-i-need-a-private-key-to-verify-a-jwt/129774/4 "2024-03-16T01:03:15Z")

</div>

Hey there @okneloper !

> [@okneloper](#):
>
> Ok, it looks like I actually can verify a token with just the public key (which was my main concern), but still curious why [jwt.io](http://jwt.io) requires a private key. This is pretty confusing.

Thanks for following up on this - I agree the language there is a bit confusing 🤔 FWIW if you are using RS256 [jwt.io](http://jwt.io) should automatically verify the signature for you without having to paste in your public key at all. It does this by using the issuer `iss` claim to call the [jwks endpoint](https://auth0.com/docs/secure/tokens/json-web-tokens/json-web-key-sets) and use the public key from there.

 ![Screenshot 2024-03-15 at 6.03.02 PM](https://global.discourse-cdn.com/auth0/original/3X/c/3/c3685add19b6c137aa756302f196321c92ab882f.png)

---

_[View the full topic](https://community.auth0.com/t/why-do-i-need-a-private-key-to-verify-a-jwt/129774)._