Sign Your First RS256 JWT

Get from zero to a verified RS256 JWT quickly. Generate a PEM key pair with the RSA Key Generator, sign a short-lived token with your JWT library, verify with the public key only, and keep the private key out of git and mobile apps.

Last updated August 26, 2026

Steps

  1. 1

    Open the RSA Key Generator and create a 2048-bit key pair in your browser.

  2. 2

    Store the private key in a secrets manager or secure env var; keep the public key for verifiers (or JWKS later).

  3. 3

    Sign a test payload with algorithm RS256 and a short exp (for example 15 minutes).

  4. 4

    Verify the token using only the public key and an explicit algorithms: ['RS256'] allowlist.

  5. 5

    Confirm a tampered payload fails verification with the JWT Validator or your test suite.

  6. 6

    Read the HS256 vs RS256 comparison if you are still choosing between shared secrets and asymmetric keys.

Generate RSA Keys

Related Comparisons

HS256 vs RS256

Related Articles

How To Generate Jwt SecretWhat Is A Jwt Secret KeyHow To Validate Jwt Token

Frequently Asked Questions

Can verifiers use the private key?

No. Only the signer should hold the private key. Verifiers need the public key (or JWKS). Sharing the private key defeats the purpose of RS256.

2048 or 4096 bits?

2048-bit RSA is the usual production default for new RS256 deployments. Use 4096-bit keys when compliance or long-lived root policy requires a larger modulus.

Does the browser RSA tool send my keys to a server?

No — key generation is entirely client-side using Web Crypto. Still treat the private PEM as secret after you copy it, and never commit it to git.

Can I still use the JWT Encoder for RS256?

Our browser encoder focuses on HS256 workflows. Sign RS256 in your backend with the PEMs from the RSA Key Generator, then inspect tokens with the decoder/validator.