When creating and validating JSON Web Tokens, choosing the appropriate cryptographic signing algorithm is critical. The two industry standards are HS256 (HMAC with SHA-256) and RS256 (RSA Signature with SHA-256).
HS256 is symmetric and blindingly fast, but requires sharing a secret key across every service. RS256 is asymmetric, enabling public verification at scale without exposing signing authority. Let's compare their mechanics, performance benchmarks, and architectural tradeoffs.
1. Symmetric vs. Asymmetric Cryptography
The core distinction comes down to the number of keys involved:
🔑 Key Architecture: Symmetric (HS256) vs Asymmetric (RS256)
Cryptographic Architecture- Symmetric (HS256): Uses a single shared secret. The same secret key that generates the signature is used by everyone to verify the signature.
- Asymmetric (RS256): Uses a public/private keypair. A private key (kept strictly confidential on the authentication server) creates the signature. A public key (distributed openly to the world) verifies the signature.
HS256 (Symmetric):
Auth Server [Shared Secret: "k8#9!xP"] -----> Microservice A [Shared Secret: "k8#9!xP"]
-----> Microservice B [Shared Secret: "k8#9!xP"]
-----> Third-Party API [Shared Secret: "k8#9!xP"] (DANGEROUS!)
RS256 (Asymmetric):
Auth Server [Private Key: PEM] -----> Signs token
Public Key Endpoint (JWKS) -----> Microservice A [Public Key: PEM]
-----> Microservice B [Public Key: PEM]
-----> Third-Party API [Public Key: PEM] (SAFE!)2. Technical Comparison Matrix
| Criterion | HS256 (HMAC-SHA256) | RS256 (RSA-SHA256) |
|---|---|---|
| Key Architecture | 1 shared secret key (symmetric) | Keypair: Private key + Public key (asymmetric) |
| Minimum Recommended Key Size | 256 bits (32 random bytes) | 2048 bits (RSA modulus) |
| Signing Speed | Extremely fast (~1,000,000 ops/sec per core) | Moderate (~2,000 to 5,000 ops/sec per core) |
| Verification Speed | Extremely fast (~1,000,000 ops/sec per core) | Fast (~25,000 ops/sec per core) |
| Signature Size in Token | 32 bytes (43 Base64URL characters) | 256 bytes (342 Base64URL characters) |
| Total Token Size | Compact (~250 to 450 bytes) | Larger (~600 to 950 bytes) |
| Microservices Suitability | Risky: any verifier can forge valid tokens | Ideal: verifiers only have the read-only public key |
| JWKS Key Distribution | Unsupported (cannot expose secret via HTTP) | Standard via /.well-known/jwks.json |
3. Why RS256 Is the Standard for Microservices
Consider a modern company with 20 microservices (Order Service, Billing Service, Notification Service, Analytics, etc.).
If you use HS256, all 20 microservices must possess the shared secret key to verify incoming tokens. If a vulnerability is found in the low-priority Analytics service and an attacker dumps its environment variables, the attacker now possesses the signing secret. They can forge administrative tokens with arbitrary permissions for the Billing and Database services!
With RS256, the private signing key resides exclusively in the Auth Server. The remaining 19 microservices download the public key from the standard JSON Web Key Set (JWKS) URL (e.g. https://auth.company.com/.well-known/jwks.json). Even if an attacker completely compromises 10 microservices, they only obtain the public key—they cannot forge a single new token.
4. The Performance Benchmark Reality
Developers often worry about the performance cost of asymmetric cryptography:
- HMAC verification is roughly 20x to 40x faster than RSA verification in raw microbenchmarks.
- However, in real-world application metrics, RSA-2048 verification takes approximately 0.04 milliseconds (40 microseconds) on modern cloud CPU hardware.
- Compared to the 20 to 100 milliseconds typical of database queries and HTTP network transport, 40 microseconds is negligible (less than 0.1% of total request time).
Unless your application processes over 100,000 requests per second per node, RS256 computational overhead will never be your bottleneck.
5. What About ES256 and EdDSA?
If you want the security of asymmetric keypairs with the compact footprint of HMAC, modern identity systems are adopting Elliptic Curve algorithms:
- ES256 (ECDSA using P-256 and SHA-256): Uses 256-bit elliptic curve keys that provide equivalent cryptographic strength to a 3072-bit RSA key, but with a much smaller signature (64 bytes vs 256 bytes) and faster computation. Standard in Apple Sign In and WebAuthn/FIDO2.
- EdDSA (Ed25519): Modern Edwards-curve Digital Signature Algorithm offering fast, deterministic, side-channel attack resistant signatures.
6. Which Algorithm Should You Choose?
- Use HS256 if: You have a single monolith where only one backend server creates and verifies tokens, or embedded IoT devices where CPU cycles and memory are severely constrained.
- Use RS256 if: You are building microservices, mobile apps, single-page apps, or integrating with OAuth 2.0 / OpenID Connect identity providers (Okta, Auth0, Google, Keycloak).
- Use ES256 if: You want cutting-edge asymmetric security with smaller HTTP header sizes and faster signatures.