JWT Signing Algorithms

2048 bits minimum (3072 or 4096 bits preferred)

RS256 is the most widely deployed JWT signing algorithm. It uses RSA private key signing with SHA-256 hashing. The private key signs tokens (held by the issuer); any party with the public key can verify them. Public keys are distributed via JWKS (/.well-known/jwks.json). Google, Auth0, Okta, and most identity providers default to RS256.

256 bits minimum (32 bytes) – same as the hash output length

HS256 uses a shared secret to both sign and verify JWTs. It is the simplest JWT algorithm – fast, no PKI required, small signatures. However, the secret must be shared with every service that verifies tokens. A compromised verifier can forge tokens. Use HS256 only when all signers and verifiers are fully trusted components of the same system.

256-bit EC key (equivalent security to 3072-bit RSA)

ES256 uses Elliptic Curve Digital Signature Algorithm (ECDSA) with the P-256 curve and SHA-256. It produces a 64-byte signature (vs 256 bytes for RS256) with equivalent security to a 3072-bit RSA key. ES256 is faster to sign and verify than RS256 and produces smaller tokens. Used by Apple (Sign in with Apple), Cloudflare, and modern high-throughput systems.

2048 bits minimum (same recommendation as RS256)

PS256 is RSA-PSS (Probabilistic Signature Scheme) with SHA-256. It is more secure than RS256 (PKCS#1 v1.5) because PSS uses salt randomization, making signatures non-deterministic and preventing certain theoretical attacks against PKCS#1 v1.5 padding. RFC 8725 recommends PS256 over RS256 for new implementations. Uses the same RSA key pairs as RS256.