I was trying to verify the following JWT on JWT.io with the following public key:
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJFVS5FT1JJLk5MODEyNDU4ODM3IiwiYXVkIjoiRVUuRU9SSS5OTDIxOTA0ODExMyIsImNsaWVudF9pZCI6IkVVLkVPUkkuTkwyMTkwNDgxMTMiLCJleHAiOjE1NjUyNTg1MzEsIm5iZiI6MTU2NTI1NDkzMSwiaWF0IjoxNTY1MjU0OTMxLCJzY29wZSI6WyJpU0hBUkUiXX0.uD3Y0QKQMM6fy3th7ceuFbqHLwsWWfJxK-HvA0cCZL2ZMiRko6tiuyrg7uci5aDIs4qpFsKMzBj_RJLGz3phLp9ViBMfHDav2nPpwkJjXZpUVJ3IFl9HjSlMRo2Ggiizl99GSWk-kIr0nTF8VbWeOY62-y14bJIWxl31JSUezyBc7jKqnDt7dZboO1QaO4oEpbj2YuBKkjJno02vnJX6c4pnfyWdOqe7RWrP_upnV3GdLgWaG2pCBvIPYejqlzQjcwBWZ6TBRanG9sNye-9jn1-4KFMQ_Q_3VV-3Xi97U8RwsyXUEuSq_41J5mT25V1JRSB822lDRqnjysL9HskJMA
Key
-----BEGIN CERTIFICATE-----
MIID8zCCAtugAwIBAgIINUOGwbq0IfAwDQYJKoZIhvcNAQELBQAwPDE6MDgGA1UEAwwxVEVTVCBpU0hBUkUgRVUgSXNzdWluZyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBHNTAeFw0xOTA3MjQxMTQ4MDJaFw0yMTA3MjMxMTQ4MDJaMH8xEDAOBgNVBAMMB0lOTk9QQVkxHDAaBgNVBAUTE0VVLkVPUkkuTkw4MTI0NTg4MzcxFzAVBgNVBAsMDkZ1biBEZXBhcnRtZW50MRMwEQYDVQQKDApJTk5PUEFZIEJWMRIwEAYDVQQHDAlBbXN0ZXJkYW0xCzAJBgNVBAYTAk5MMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyI3mSTlTr3aGACMewLMFomVm3E6OvUku3xjHvNm0Ji/fzkoyLVQLEEVz6mtmEj5W0qYeCBJi+tKxmT+MEBNPc22TFCCtCPxUEov9NEeIK6Ku+GU700Qj3wY1hB/mZqw4JH22jxLOOSU01Vga/GFADF0TuWCVhOu7CJxCy64uuH5IcIB+bdgzwbkoQMQQ5WtKSO3hbI7mNG78akmZ3UDxU4ZkS9NhCamu5PBrdQWc5JWwooENLGBtqTaVXZBRyDoLq4SJ6pr+yKScyMp9LEe/Uc2hUKnoq7G5VpJaEfUehKS3kEbL+6thvsRf0eFz7HcqXMUyETAfcBf336TRG5HIWQIDAQABo4G1MIGyMB8GA1UdIwQYMBaAFG3FZYnL35FU0Ws8twKlLs2KaJAdMCcGA1UdJQQgMB4GCCsGAQUFBwMCBggrBgEFBQcDBAYIKwYBBQUHAwEwNwYIKwYBBQUHAQMEKzApMAgGBgQAjkYBATAIBgYEAI5GAQQwEwYGBACORgEGMAkGBwQAjkYBBgIwHQYDVR0OBBYEFLCpV8Zrw1FYM3jdGpmOVVgkMY0mMA4GA1UdDwEB/wQEAwIGwDANBgkqhkiG9w0BAQsFAAOCAQEAbJ08bV7+zfFsWsjZR106H8bQGCGWOM47KeNi5/qROI0AVWPkSm63OiyYMGFJNxxEdUL8E8Tpkuy7mc5JmvZYOoLNrpb4HH8OAS0Q4EzKNW2uA2LiLWFaokiLGZDJgwEaLHhaFaGrCg2yOu2NdWOeojC23STJ0Jkb4TdySNsd6K8RJ0BeYqSazLU5BJBiWxM4pL5hNNYQa1BWbmWSTFcku+wfcoir+7Lp57IxW0w6MTaJM9tsMlZZ+QMZtTEkcm1QiALxSctdABjf1fylbwrnlievFKFuCzlrlgN+WDVnyAAUgOXirtgRXGzfpJD8lqGXAmAtcesnNxKfrd4eux6Gfg==
-----END CERTIFICATE-----
And it verifies! Nice! However, I was testing if it would still work with some small modifications. For example, if I remove the last three characters from the certificate ('Gfg') it still verifies! Or if I do a small change to some characters in the certificate (i.e. change 'R' to 'S' or '3' to '4') it will also verify.
Why does this happen? Does it have to do with the RS256 algorithm, or with JWT? I would have thought that the certificate-value would have to be very precise in order to verify the private key!