HS256 vs RS256: Symmetric vs Asymmetric JWTs

JWT signing uses either symmetric (HMAC) or asymmetric (RSA, ECDSA) algorithms. HS256 = HMAC-SHA256. RS256 = RSA-PKCS1v1.5-SHA256. ES256 = ECDSA-P256-SHA256. The choice impacts key distribution and trust model.

HS256 uses a single shared secret key for both signing and verification. Both the issuer and every verifier must possess the same secret. Simple to implement but requires secure key distribution to all verifiers.

HS256 is appropriate when issuer and verifier are the same service (e.g., a monolithic API signing and verifying its own tokens). Never use HS256 if multiple independent services need to verify tokens — they all need the secret.

RS256 uses a private key to sign and a public key to verify. Only the auth server holds the private key. All resource servers fetch the public key from the JWKS endpoint and verify locally — no secret sharing required.

RS256 is ideal for microservices architectures: the identity provider signs tokens; each downstream service verifies with the public key without contacting the IDP per request. Scales horizontally without key distribution risk.

ES256 uses ECDSA over P-256. Signature size is 64 bytes vs RS256's 256 bytes for a 2048-bit key. Verification is ~10x faster than RS256. Preferred when bandwidth or verification speed is critical (mobile APIs, IoT).

For RS256/ES256: rotate keys by publishing new key (new kid) to JWKS, signing new tokens with the new key, allowing a grace period for old tokens to expire, then removing the old key. HMAC rotation requires re-distributing the new secret.

HS256 verification: ~1 µs. RS256 verification: ~100 µs (2048-bit). ES256 verification: ~50 µs (P-256). HS256 is fastest but requires secret sharing. ES256 best balances security and performance for distributed systems.

A critical vulnerability: if the verifier trusts the alg header blindly, an attacker can change alg from RS256 to HS256 and sign the token with the server's public key (which is public) as the HMAC secret. Fix: never trust the alg header.

Decision: single-service → HS256. Multi-service/microservices → RS256 or ES256. High-volume mobile → ES256. If in doubt, use ES256 (P-256) or RS256 with 2048+ bit keys. Never use RS512 for performance-sensitive paths.

Use PyJWT (Python), jose (Node.js), or auth0/java-jwt. Always pin the expected algorithm in the verify call: jwt.decode(token, secret, algorithms=["HS256"]). Never pass algorithms=None or omit the parameter.

Why is RS256 preferred over HS256 in microservices architectures?

HS256 is symmetric (shared secret); RS256/ES256 are asymmetric (private sign, public verify). Use asymmetric algorithms for multi-party systems. Next: exploiting JWT vulnerabilities.