Developer
Encoders, converters & dev utilities
HS256 vs RS256 — Which JWT Signing Algorithm?
HS256 and RS256 are the two most common JWT signing algorithms, and the difference is symmetric vs asymmetric. HS256 (HMAC-SHA256) uses one shared secret to both sign and verify — simple and fast, but every party that can verify can also mint tokens, so the secret must be guarded and never shipped to clients. RS256 (RSA PKCS#1 v1.5 with SHA-256) uses a private key to sign and a separate public key to verify — the public key can be published (as a JWKS) so any service can verify without being able to forge tokens. Rule of thumb: use HS256 when a single trusted service both issues and verifies; use RS256 (or ES256) when tokens are issued centrally and verified by many independent services, or when verifiers should not hold signing power. Both are supported by this verifier. Free, no login, all in-browser.
HS256 = HMAC-SHA256, symmetric: ONE shared secret both signs and verifies
- RS256 = RSA PKCS#1 v1.5 + SHA-256, asymmetric: private key signs, public key verifies
- ES256 = ECDSA on P-256 — asymmetric like RS256 but with smaller keys/signatures
- HS256 risk: anyone who can verify can also forge — never expose the secret to clients
- RS256 benefit: publish the public key (JWKS); verifiers cannot mint tokens
- Use HS256 for a single issuer+verifier service; RS256/ES256 for many independent verifiers
- Security: never let the token header switch RS256→HS256 (key-confusion attack) — pin alg to key type
Frequently asked questions
What is the difference between HS256 and RS256?
HS256 is symmetric: it uses HMAC-SHA256 with a single shared secret that both signs and verifies tokens. RS256 is asymmetric: it signs with an RSA private key and verifies with the corresponding RSA public key. The practical consequence is who can forge tokens. With HS256, anyone holding the secret (which every verifier needs) can also create valid tokens. With RS256, only the holder of the private key can sign, while the public key — which you can freely publish as a JWKS — lets any number of services verify without the power to mint tokens.
Which should I use, HS256 or RS256?
Use HS256 when the same trusted service both issues and verifies tokens and you can keep the shared secret private — it is simpler and slightly faster. Use RS256 (or ES256) when tokens are issued by one central authority but verified by many separate services, or in any case where verifiers should not be able to create tokens. RS256 is the standard for OIDC/OAuth2 because identity providers publish a JWKS of public keys that resource servers use to verify without ever holding signing power.
Can I verify an RS256 token by pasting the public key as an HS256 secret?
No — and doing so is exactly the key-confusion vulnerability. If a verifier trusts the token's alg header, an attacker can take an RS256 system, change the header to HS256, and sign the token using the (public) RSA public key as the HMAC secret. Because the public key is public, anyone could then forge a "valid" token. The fix is to pin the expected algorithm to the key type — an RSA key means RS256 verification only, never HS256. A correct verifier refuses to reinterpret an asymmetric public key as a symmetric secret.