JWT Algorithms·7 min read·2026-03-12T15:00:00Z

HS256 vs RS256: The Real-World Engineering Trade-Offs

When designing microservice authentication, developers face the classic question: Should we use HS256 with a shared secret or RS256 with public key verification? Here is the complete architectural breakdown.

Performance Benchmark: HMAC vs. RSA

HS256 verification is approximately 10 to 20 times faster in CPU execution than RS256 signature verification. If your API gateway handles 100,000 requests per second, HMAC provides substantial CPU efficiency gains. However, RS256 eliminates the need to distribute sensitive secrets to every consuming service.

Frequently Asked Questions

What is the algorithm confusion attack between HS256 and RS256?

An attacker takes an RS256 public key (which is public knowledge) and uses it as the secret key with HS256. If a server naively checks the token with its public key using HMAC, the signature validates. Always verify tokens with an explicit algorithm whitelist.

HS256 vs RS256 – Secret Sharing, Performance & Architecture | Générateur de Clé Secrète JWT | JWT Secret Key Generator