All questions
Q & A Security · September 11, 2026

What is the difference between HS256 and RS256?

HS256 is HMAC with SHA-256 — a symmetric algorithm where the same secret both signs and verifies tokens. Anyone holding the secret can forge tokens, so it’s only appropriate when the signer and verifier are the same trust boundary. RS256 is RSA signature with SHA-256 — asymmetric. The signer uses a private key; verifiers use the public key. RS256 is the right choice for OAuth issuers whose tokens are verified by many downstream services.

Read the full guide
What Is a JWT? JSON Web Token Structure, Signing, and Security Explained
JWT (JSON Web Token) is the dominant format for API authentication, OAuth access tokens, and stateless session management. Three base64-encoded segments carry the header, claims, and signature — anyone can read them, but only the key holder can produce a valid token.
Related questions
Are UUIDs guaranteed to be unique? Can I revoke a JWT before it expires? Can I use UUID as a primary key? How do I verify a JWT signature without the secret? How much larger does Base64 make my payload?