CodePark/ questions / JWT in depth
START PRACTICINGPRACTICE
Backend question · Auth & security › JWT in depth

What is the difference between HS256 and RS256 for signing JWTs, and when would you pick each?

HS256 uses one shared secret to sign and verify. RS256 uses a private key to sign and a public key to verify.

HS256 is HMAC with SHA-256. The same secret key signs and verifies tokens. So every service that can verify tokens can also forge (fake) them. It's fine when one single service both issues and checks its own tokens. The secret must be long and random.

RS256 (RSA) and ES256 (ECDSA) are asymmetric: they use a key pair. The authorization server signs with a private key. It publishes the public keys, usually at a JWKS endpoint (a URL that lists public keys). Resource servers (your APIs) verify tokens with the public key. This gives three benefits:

  • An API that gets hacked can't create tokens.
  • You rotate keys by publishing a new key with a new kid (key id).
  • Third parties can verify tokens without holding any secret.

Use asymmetric signing for microservices, for multiple token consumers, and for any OAuth or OIDC setup. ES256 gives smaller keys and signatures than RS256.

  • HS256 uses one shared secret to both sign and verify.
  • Any service that has the HS256 secret can forge tokens.
  • With RS256 or ES256, a private key signs and a public key verifies.
  • Public keys are shared through a JWKS endpoint and rotated by kid.
  • Use asymmetric signing for multiple services and for OAuth or OIDC.