Security
JWT Signing: HS256 vs RS256 Explained
Every JSON Web Token (JWT) is signed with a cryptographic algorithm, and the two most common choices are HS256 and RS256. HS256 uses a single shared secret with HMAC-SHA256, while RS256 uses asymmetric RSA keys with a private key for signing and a public key for verification. The choice affects key distribution, token security, and how easily your API can scale. Understanding HS256 vs RS256 is essential for anyone implementing authentication.
1.HS256: Symmetric Signing with a Shared Secret
HS256 signs a JWT using HMAC-SHA256, where the same secret key both signs and verifies the token. The algorithm is simple and fast, and it is the default in many quick-start tutorials because it requires no key generation or certificate setup. The critical requirement is that the secret must be kept private everywhere — client and server. If the secret leaks, anyone can forge tokens. Because both sides hold the same key, HS256 works best when the verifying party is a single service you fully control.
2.RS256: Asymmetric Signing with Key Pairs
RS256 signs a JWT using RSA-SHA256 with a private key, and any party with the corresponding public key can verify the signature without being able to create new tokens. The issuer holds the private key; API gateways, microservices, and third parties hold only the public key. This makes RS256 the standard for identity providers (like Auth0, Keycloak, and Google) because many consumers can verify tokens independently and safely. RSA verification is slower than HMAC, but the security and key-distribution benefits usually outweigh the cost.
3.Key Differences: Security and Key Management
The core difference is who can sign. With HS256, anyone who knows the secret can both sign and verify, so the secret must be shared with every verifier — a scaling and security risk if many services verify tokens. With RS256, only the private key holder can sign, and anyone with the public key can verify without increasing the attack surface. This makes RS256 the recommended choice for distributed systems and any situation where tokens are verified by more than one party.
4.Which Algorithm Should You Use?
Use RS256 whenever tokens may be verified by multiple services, third parties, or public clients, and whenever you want to guarantee that only your server can mint tokens. Use HS256 only for a single-service backend where the secret can be tightly controlled, and treat the secret with the same rigor as a database credential. Always validate the algorithm in your JWT library to prevent algorithm-confusion attacks, and use our JWT decoder to inspect the header, payload, and signature of any token.
Try the tools
Run these conversions and checks instantly in your browser — no data leaves your device.
Frequently Asked Questions
What is the difference between HS256 and RS256?
HS256 is symmetric — the same secret signs and verifies. RS256 is asymmetric — a private key signs and a public key verifies. RS256 is safer for distributed systems because only the issuer can create tokens.
Is HS256 secure?
HS256 is secure if the shared secret is strong and kept secret on both ends. It becomes risky when multiple services must verify tokens, because every verifier must hold the signing secret.
Why do identity providers use RS256?
Identity providers like Auth0 and Google use RS256 so that any client or API can verify tokens with just the public key (available from the JWKS endpoint) without ever holding the private signing key.
How can I decode and inspect a JWT?
Use our free JWT decoder to view the header, payload, and signature of any token instantly in your browser, and our JWT generator to create test tokens with the algorithm you choose.
More comparisons
Explore side-by-side guides for other developer tools and formats.
View all comparisons