RS256
acronymcryptographysecurity
Stands for: RSA signature with SHA-256 (JWA identifier)
A JWT signing algorithm: RSA with SHA-256.
RS256 is a JSON Web Algorithm identifier (RFC 7518) for an RSA signature using SHA-256. It is one of the most common JWT signing algorithms, paired with a public key published in a JWKS.
RS256 signs a JWT with an RSA private key and SHA-256, so verification needs only the corresponding public key. That asymmetry is why it is the default for anything involving more than one party: an identity provider signs, any number of services verify, and none of them holds anything that could forge a token.
This is what makes JWKS endpoints work. The provider publishes its public keys, verifiers fetch and cache them, key rotation happens without coordinating with every consumer, and the private key never leaves the issuer. Every OIDC deployment of consequence runs on this arrangement.
The trade against HS256 is cost and key size, and both matter less than they used to. RSA verification is fast even though signing is not, and verification is the operation that happens constantly. Where RS256 is genuinely under pressure is from elliptic curve alternatives, since ES256 delivers equivalent security with dramatically smaller keys and signatures, and a JWT is a thing that travels in an HTTP header where size is not free.
Also known as: rs256