HS256 or RS256 for Your JWTs?
Shared secret vs public key signing, when each fits, and the checks every verifier must make.
By the TurantTools Dev team · Updated October 27, 2026 · 3 min read
Most JWTs are signed with HS256 or RS256 (or ES256). The choice comes down to who needs to verify the token.
| HS256 (HMAC) | RS256 / ES256 (public key) | |
|---|---|---|
| Keys | One shared secret | Private key signs, public key verifies |
| Who can verify | Anyone with the secret, who can also create tokens | Anyone with the public key, who can't create tokens |
| Good for | One service that issues and checks its own tokens | Many services, or third parties, verifying tokens from one issuer |
| Key sharing | Must be kept secret everywhere it's used | Public keys can be published (JWKS) |
Checks every verifier must make
- Pin the expected algorithm; never trust the token's own
algheader, and rejectnone. - Check
exp,nbf, the issuer (iss) and the audience (aud). - For HS256, use a random secret of at least 256 bits, not a word or a short string.