RS512: RSASSA-PKCS1-v1_5 with SHA-512 in a JWT

The naming trips people repeatedly. In HS512 the number is the hash size and the key is symmetric; in ES512 it points at curve P-521; in RS512 it is the digest and the key size is a separate decision entirely. A 2048 bit RSA key signing with SHA-512 is a perfectly ordinary RS512 configuration, and nothing about the algorithm name implies a 4096 bit key.

Signature length follows the modulus, so RS512 with a 2048 bit key yields the same 342 base64url characters as RS256 with that key. The digest is hashed down to 64 bytes and wrapped inside the PKCS#1 v1.5 structure before the RSA operation, so the extra hash output is absorbed rather than added. The only way to make the token longer is to use a longer key.

SHA-512 is the same underlying compression function as SHA-384 without the truncation, and on 64 bit hardware it is fast. The cost that matters is the RSA operation itself: signing scales sharply with key size while verification stays cheap, so an issuer minting many tokens per second feels a 4096 bit key long before any resource server does.

For verification the decoder needs the PEM public key and nothing else, and it does the work in your browser. If a token fails here with the correct key, the signature really is wrong, which rules out the two usual suspects at once: an unsupported algorithm in whatever rejected it, and a key that was published for a different signing key entirely.