ES256
recommendedECDSAECDSA using P-256 and SHA-256
RFC 7518 §3.4
ES256 uses Elliptic Curve Digital Signature Algorithm (ECDSA) with the P-256 curve and SHA-256. It produces a 64-byte signature (vs 256 bytes for RS256) with equivalent security to a 3072-bit RSA key. ES256 is faster to sign and verify than RS256 and produces smaller tokens. Used by Apple (Sign in with Apple), Cloudflare, and modern high-throughput systems.
Details
ES256 (ECDSA P-256 SHA-256) is the modern asymmetric JWT algorithm. Like RS256, it uses a private key to sign and a public key to verify, but with much better performance and smaller key/signature sizes.
Comparison to RS256: Key size: 256-bit EC ≈ 3072-bit RSA in security Signature: 64 bytes (ES256) vs 256 bytes (RS256) – 4× smaller Signing speed: EC is significantly faster than RSA Verification: EC verification is faster than RSA
P-256 security: NIST P-256 (secp256r1) is approved by NIST SP 800-186. The 256-bit key provides approximately 128 bits of security. Considered secure through at least 2030+ by NIST.
Portability concern: ECDSA is widely supported but slightly less universal than RSA in legacy systems. For maximum compatibility with older IdPs and libraries, RS256 remains safer. For modern high-throughput systems, ES256 is preferred.
Signing randomness: ECDSA requires a unique random nonce per signature. A reused nonce leaks the private key (as demonstrated by the Sony PS3 hack). Modern implementations use RFC 6979 deterministic ECDSA to eliminate this risk.
Key Information
| Key type | ECDSA key pair (P-256 / secp256r1) |
| Key size | 256-bit EC key (equivalent security to 3072-bit RSA) |
| Family | ECDSA |
| Spec | RFC 7518 §3.4 |
Advantages
- +4× smaller signatures than RS256 (64 bytes vs 256 bytes)
- +Faster signing and verification than RSA
- +Equivalent security to RS256 at much smaller key sizes
- +Used by Apple Sign In, Cloudflare, modern IdPs
Limitations
- !Slightly less universal library support than RSA
- !Requires deterministic signing (RFC 6979) to avoid nonce reuse attacks
- !P-256 curve has some theoretical academic concerns (less than Curve25519) though considered safe for practical use
When to use
High-throughput API gateways
Mobile authentication (Sign in with Apple)
Edge verification where token size matters
Modern microservice architectures