title: Verifying jwt tokens [rsa]
body: <p>A collegue and myself have been trying to understand how jwt tokens verify tokens, but from our reading we seem to be confusing ourselves.</p>
  
  <p>Please can someone help confirm whether my thinking is correct</p>
  
  <ul>
  <li>Tokens are signed using the private key. The signature is a combination of the header and payload encrypted using the private key and added to the jwt as the last part, the signature.</li>
  <li>In order to verify the token the receiver can replicate this process using the public key. They encrypt the header and payload to see if it the same as the signature. Note this is not decryption. The receiver is not decrypting the token (this is the main thing we are unsure of).
  -The receiver cannot issue new tokens as they do not have the private key to encrypt a new token with.</li>
  </ul>
  
  <p>I have read the jwt documentation on both RS256 and HS256 and still struggling to confirm my thinking, hence the post.</p>