Is the content of a signed JWT (such as an ID token) secret, and what is the difference between HS256 and RS256?
No: a signed JWT is only encoded, not encrypted, so anyone holding it can read the claims; the signature only proves integrity and origin. HS256 signs with a shared secret (HMAC with SHA-256), RS256 with the issuer's RSA private key, verified with its public key.
Base64url is an encoding, not a cipher: paste any ID token into a decoder and the name and email inside are readable. A signed JWT (JWS) guarantees that the claims were not changed and that they come from the key holder. If the content must stay confidential, the token must additionally be encrypted (JWE), and in any case it should only travel over TLS.
| HS256 | RS256 (or ES256) | |
|---|---|---|
| Mechanism | HMAC with SHA-256, a symmetric MAC | RSA signature with SHA-256 (ES256: elliptic curve) |
| Key | One shared secret (in OIDC: the client secret) | Private key at the OP, public key published via jwks_uri |
| Who can verify | Only parties holding the secret, who could also forge tokens | Anyone with the public key; only the OP can sign |
| Fits | One client and one issuer that share a secret | Many RPs verifying one OP, key rotation, public clients |
RS256 is the common default for ID tokens, because the OP can publish its public keys and no RP can produce tokens in the OP's name.
Go deeper:
RFC 7519, Section 3: JSON Web Token Overview — JWS-signed versus JWE-encrypted tokens.- HMAC (Wikipedia) — how the keyed hash behind HS256 works.