PS256
recommendedRSASSA-PSSRSASSA-PSS using SHA-256 and MGF1 with SHA-256
RFC 7518 §3.5
PS256 is RSA-PSS (Probabilistic Signature Scheme) with SHA-256. It is more secure than RS256 (PKCS#1 v1.5) because PSS uses salt randomization, making signatures non-deterministic and preventing certain theoretical attacks against PKCS#1 v1.5 padding. RFC 8725 recommends PS256 over RS256 for new implementations. Uses the same RSA key pairs as RS256.
Details
PS256 (RSASSA-PSS with SHA-256 and MGF1) addresses a theoretical weakness in RS256's PKCS#1 v1.5 padding. PSS uses a random salt in the padding, making each signature different even for the same input – unlike PKCS#1 v1.5 which is deterministic.
Why PSS over PKCS#1 v1.5 (RS256): - PSS is the modern RSA signature scheme per PKCS#1 v2.1 and FIPS 186-5 - RS256 uses the older PKCS#1 v1.5 padding which has known (though not practically exploitable) weaknesses - RFC 8725 §3.2 recommends PS256 for new implementations
Key compatibility: PS256 uses the same RSA key pairs as RS256. You can generate one 2048-bit RSA key and use it for both RS256 and PS256 signing (though you should not mix algorithms with the same key).
Deployment: PS256 is supported by most modern JWT libraries (jose, python-jose, java-jwt) but some legacy libraries may not support PSS padding. Check library support before choosing PS256 over RS256 for compatibility reasons.
Signature size: same as RS256 – 256 bytes for a 2048-bit RSA key.
Key Information
| Key type | RSA key pair (same keys as RS256) |
| Key size | 2048 bits minimum (same recommendation as RS256) |
| Family | RSASSA-PSS |
| Spec | RFC 7518 §3.5 |
Advantages
- +More secure padding than RS256 (PKCS#1 v1.5) – recommended by RFC 8725
- +Same RSA key pairs as RS256 – no new PKI infrastructure needed
- +Non-deterministic signatures (random salt per signature) – prevents certain attacks
Limitations
- !Slightly lower library support than RS256 in legacy systems
- !Same large signature size as RS256 (256 bytes)
- !Same slower performance as all RSA algorithms
When to use
New implementations where RFC 8725 compliance matters
FIPS-compliant environments (FIPS 186-5 mandates PSS for new RSA signatures)
High-security JWT issuance replacing RS256