How does BetterDB Monitor prevent tampering with offline license tokens?

Every entitlement is issued as a signed RS256 JWT.

BetterDB Monitor verifies that signature locally, against public keys already embedded in the image, so it never has to contact a license server to decide whether to trust a given token – which is exactly what makes true air-gapped operation possible.

Because the token is signed, any edit to its contents – changing the tier, extending an expiry date, and so on – breaks the signature. A tampered token doesn't get silently accepted; it simply fails local verification and the instance reverts to whatever it's actually entitled to.

This is also what makes true offline operation trustworthy rather than just "unverified": a naive offline mode might have to just trust whatever file is present, but RS256 verification against embedded public keys means the monitor can distinguish a genuine BetterDB-issued entitlement from an arbitrary JSON file someone dropped in, even with zero network access to check.