title: Where does jwt.io get the public key from JWT token?
body: <p>I was decoding a JWT token via <a href="https://jwt.io" rel="noreferrer">jwt.io</a> (in the Debugger section) to see Headers, Payload. Surprisingly, it also verified, and I could see it (jwt.io debugger) is able to retrieve the public key as well.</p>
  <p>So my question is: Does JWT token provide the public key as well as part of the JWT token?</p>
  <p>I am pasting part of it (can't paste full due to security reasons, will be truncating part of the actual JWT token)</p>
  <pre><code>F3cy5jb21cL2V1LXdlc3QtMV9ZckVRYjY5Z1giLCJleHAiOjE2MDE2Mzg4OTMsImlhdCI6MTYwMTYzNTI5MywidmVyc2lvbiI6MiwianRpIjoiNmI2YmZiNmYtY2M0MS00N2Q5LWI0YzYtOTBmOGFmNWM2MjQ1IiwiY2xpZW50X2lkIjoiMTM0MWxxa3N1ZmUwbm1vaW9kdnRjc2t2cWIifQ.RtKfz54uBgSZ1gc4KRPjzL4dPe5AbH2YMJu-DDvIxBzgMjqT9q4ApGzcWYB62-MgDUf-F_hK0kF9eIwAi9fARhp 0HGGnyiuydW_our6zE3EphLvXQByTDY5xzOUuSvt7WbDZWeSfpHcjrBttRSJAPOsZ2gInafKjZgWKyGL4vJB9swEhOMSSpTQDGWKenJCyp4emhe8E4XGzYTo9WEb-Wqg6sI__LrusDNd917FaocPKBxA
  </code></pre>
  <p><strong>Decoded messages (again truncated)</strong></p>
  <p>Headers</p>
  <pre><code>{
    &quot;kid&quot;: &quot;cJ0PzkBXPyjX7FM67jcOECIY=&quot;,
    &quot;alg&quot;: &quot;RS256&quot;
  }
  </code></pre>
  <p>Payload:</p>
  <pre><code>{
    &quot;sub&quot;: &quot;13lqs0moiodvtcskvqb&quot;,  
    &quot;token_use&quot;: &quot;access&quot;,  
    &quot;scope&quot;: &quot;example.com/Manage&quot;,  
    &quot;auth_time&quot;: 1601293,  
    &quot;iss&quot;: &quot;https://cognito.eu.amazonaws.com/&quot;,  
    &quot;exp&quot;: 1601638,  
    &quot;iat&quot;: 10353,  
    &quot;version&quot;: 2,  
    &quot;jti&quot;: &quot;cc1-47d9-b6-5c6245&quot;,  
    &quot;client_id&quot;: &quot;nmodvtcb&quot;  
  }
  </code></pre>
  <p>In there, can see the <strong>Public key</strong> (truncated)</p>
  <pre><code>
  -----BEGIN PUBLIC KEY-----
  QEFAAOCAQ8AMIIBCxmf9bakWk
  556KYmIZB+Sy1ftkkGa4qlUsmRvcG2Hll+7HBWp1ao6MVLskjdaaKg8iH1Iz4DKG
  lgqT/ndwhoxvTBuvm0X2CZoNzZn4S8wDTr78m/S/YegZRhv6y58gkiKSEmbbC/g5
  Bp+AF88NwBvLm1jdd
  -----END PUBLIC KEY-----
  
  </code></pre>
  <p>Where from the debugger in jwt.io is retrieving the public key? I am not able to understand this.</p>