What is ES256 in a JWT?

ES256 stands for ECDSA using the P-256 curve (also called secp256r1 or prime256v1) with SHA-256. It is an asymmetric signature algorithm defined in RFC 7518 for JWTs. The issuer signs with an EC private key; verifiers use the matching EC public key. Signatures are exactly 64 bytes (two 32-byte scalars r and s concatenated), keys are 256 bits — much smaller than RSA equivalents while providing the same 128-bit security level. ES256 is the algorithm Apple uses for Sign in with Apple and for APNs push notification tokens; it is increasingly the default choice for new OIDC deployments.

How is ES256 different from RS256?

Both are asymmetric — private key signs, public key verifies. Differences: (1) key sizes — an RS256 key is typically 2048–4096 bits (256–512 bytes as a PEM); an ES256 key is 256 bits (about 91 bytes as a PEM). (2) signature sizes — RS256 signatures are 256 bytes, ES256 signatures are 64 bytes. This makes ES256 JWTs noticeably smaller. (3) speed — ES256 signing is faster than RSA signing; ES256 verification is slower than RSA verification but only marginally. (4) security level — RS256 at 2048 bits gives about 112 bits of security; ES256 gives 128 bits. So ES256 is smaller AND more secure at default parameters. (5) determinism — standard ECDSA is non-deterministic (each signature uses a fresh random nonce), so the same JWT signed twice produces different signatures. Some libraries offer deterministic ECDSA (RFC 6979) as an option.

What public-key format does ES256 use?

ES256 public keys are typically distributed as PEM (SubjectPublicKeyInfo), JWK (JSON Web Key), or hex-encoded uncompressed points. A PEM public key starts with -----BEGIN PUBLIC KEY----- and is about 178 characters base64 payload. A JWK has {"kty":"EC","crv":"P-256","x":"...","y":"..."} where x and y are base64url-encoded 32-byte coordinates. All standard libraries can consume any of these formats. If you got a public key from Apple/JWKS, it will be a JWK; if you generated it with openssl, it will be PEM.

How do I generate an ES256 keypair?

With OpenSSL: `openssl ecparam -genkey -name prime256v1 -noout -out private.pem` then `openssl ec -in private.pem -pubout -out public.pem`. In Node.js: `require("crypto").generateKeyPairSync("ec", { namedCurve: "P-256" })`. In Python: `cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(ec.SECP256R1())`. Store the private key in a secrets manager, distribute the public key via a JWKS endpoint or embed it in your app config. Never commit the private key to git.

Why does Apple use ES256 for its APIs?

Apple chose ES256 for Sign in with Apple, APNs (Apple Push Notification Service) tokens, App Store Server Notifications, and DeviceCheck because it fits their design constraints: (1) smaller tokens — APNs headers have byte limits; a 256-byte RS256 signature would be pushing it, whereas 64-byte ES256 fits comfortably. (2) faster signing on their servers at massive scale — Apple issues billions of tokens; ES256 signing is significantly cheaper than RS256. (3) modern crypto — P-256 is widely deployed and hardware-accelerated on iOS devices. (4) forward-compatibility — Apple can migrate to Ed25519 or newer curves more smoothly from ECDSA than from RSA. If you are integrating with an Apple API, you MUST use ES256 — they do not accept other algorithms.

What is the difference between raw and DER ES256 signatures?

This is a subtle bug source. JWT ES256 signatures MUST be the raw concatenation of r and s (each 32 bytes, big-endian, padded), total 64 bytes. But most crypto libraries default to producing DER-encoded ECDSA signatures — a variable-length ASN.1 SEQUENCE containing r and s, typically 70–72 bytes with headers. If you sign with node's crypto module using default options, you get DER, and the resulting JWT will fail verification everywhere. Libraries like jose and jsonwebtoken handle the conversion internally; if you use raw crypto APIs, convert DER to (r||s) before base64url-encoding. In the reverse direction, Web Crypto API accepts raw (r||s) format directly for ECDSA verify, which is why browser-based verification is straightforward.

Can ES256 signatures be forged if the same nonce is reused?

Yes — this is the classic ECDSA vulnerability. Every ECDSA signature uses a per-signature random nonce (k). If two signatures reuse the same k with the same private key on different messages, an attacker with both signatures can trivially recover the private key. The Sony PlayStation 3 ECDSA private key was recovered exactly this way in 2010. Every reputable library uses a CSPRNG for k or, better, RFC 6979 deterministic derivation of k from the private key and message. Never implement ECDSA signing yourself. Never modify a library's nonce generation. If you rotate ES256 keys, rotate cleanly — do not re-sign identical payloads with the same private key using different libraries.

JWT ES256 Decoder — Decode & Verify ECDSA P-256 JWTs Online

Decode any ES256 JWT and verify its ECDSA signature locally. Paste token and EC public key — smaller than RSA, faster than RS256, and Apple-compatible.

What Makes ES256 the Modern JWT Default

ES256 combines two well-vetted primitives: the NIST P-256 elliptic curve (also called secp256r1 or prime256v1) for the digital signature scheme, and SHA-256 for hashing the signing input. Together they provide 128 bits of security — the same as AES-128 — with keys and signatures small enough to fit anywhere.

Compared to RS256 at 2048-bit RSA (which provides ~112 bits of security), ES256 is faster, smaller, and slightly stronger. Compared to Ed25519 (a newer alternative gaining adoption), ES256 has broader hardware acceleration and stricter regulatory approval. If you are choosing an asymmetric algorithm for a new JWT deployment and you do not have a specific reason to use RSA, use ES256.

Real-World ES256 Deployments

Apple Sign in with Apple — id_tokens returned by Apple are signed with ES256. You verify them using the public keys published at appleid.apple.com/auth/keys.
Apple Push Notification service (APNs) — provider authentication uses ES256 JWTs (called "provider authentication tokens") signed with a key downloaded from your Apple Developer account.
App Store Server API — subscription and transaction endpoints require ES256 JWTs signed with your Apple Developer team key.
WebAuthn / FIDO2 — many authenticators produce ES256 attestation signatures that are wrapped as JWTs when transmitted server-to-server.
DPoP (Demonstrating Proof of Possession, RFC 9449) — the modern OAuth 2.0 sender-constrained access token proof uses ES256 by default.

Signing and Verifying ES256 in Every Major Language

Node.js — jose (recommended)

import { SignJWT, jwtVerify, importPKCS8, importSPKI } from 'jose';

// Sign
const privateKey = await importPKCS8(pkcs8Pem, 'ES256');
const jwt = await new SignJWT({ sub: '12345' })
  .setProtectedHeader({ alg: 'ES256' })
  .setIssuedAt()
  .setExpirationTime('1h')
  .sign(privateKey);

// Verify
const publicKey = await importSPKI(spkiPem, 'ES256');
const { payload } = await jwtVerify(jwt, publicKey, {
  algorithms: ['ES256'],
});

Python — PyJWT + cryptography

import jwt
from cryptography.hazmat.primitives import serialization

# Load keys
with open("private.pem", "rb") as f:
    private_key = serialization.load_pem_private_key(f.read(), password=None)
with open("public.pem", "rb") as f:
    public_key = serialization.load_pem_public_key(f.read())

# Sign
token = jwt.encode({"sub": "12345"}, private_key, algorithm="ES256")

# Verify
payload = jwt.decode(
    token,
    public_key,
    algorithms=["ES256"],
)

Go — golang-jwt/jwt

import (
    "crypto/ecdsa"
    "github.com/golang-jwt/jwt/v5"
)

// Sign
token := jwt.NewWithClaims(jwt.SigningMethodES256, jwt.MapClaims{
    "sub": "12345",
    "exp": time.Now().Add(time.Hour).Unix(),
})
tokenString, err := token.SignedString(ecPrivateKey) // *ecdsa.PrivateKey

// Verify
parsed, err := jwt.Parse(tokenString, func(t *jwt.Token) (any, error) {
    if _, ok := t.Method.(*jwt.SigningMethodECDSA); !ok {
        return nil, fmt.Errorf("unexpected alg")
    }
    return ecPublicKey, nil  // *ecdsa.PublicKey
})

Java — jjwt

import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.spec.ECGenParameterSpec;

// Generate ES256 keypair
KeyPairGenerator kpg = KeyPairGenerator.getInstance("EC");
kpg.initialize(new ECGenParameterSpec("secp256r1"));
KeyPair kp = kpg.generateKeyPair();

// Sign
String jws = Jwts.builder()
    .setSubject("12345")
    .signWith(kp.getPrivate(), SignatureAlgorithm.ES256)
    .compact();

// Verify
Claims claims = Jwts.parserBuilder()
    .setSigningKey(kp.getPublic())
    .build()
    .parseClaimsJws(jws)
    .getBody();

ES256 Signature Format — Raw vs DER

A subtle but critical detail: JWT ES256 signatures MUST be the raw concatenation of the two ECDSA scalars r and s, each padded to 32 bytes big-endian, total 64 bytes. Many crypto libraries default to producing DER-encoded ECDSA signatures — a variable-length ASN.1 structure that is 70–72 bytes.

If you sign a JWT using a low-level crypto API that produces DER, and then base64url-encode it directly, the resulting JWT will fail verification on every compliant verifier. Use a JWT library rather than raw crypto — jose,PyJWT, jsonwebtoken in Ruby, golang-jwt, etc. all handle the DER↔raw conversion for you.

Common ES256 Pitfalls

DER-encoded signature. Result: verification fails everywhere. Use a proper JWT library, not raw crypto.sign("ecdsa").
Using the wrong curve. ES256 is P-256 only. Signing with P-384 (that's ES384) or secp256k1 (that's ES256K, a non-standard extension used by blockchains) will not interoperate.
Confusing ES256 with ES256K. ES256 uses NIST P-256; ES256K uses secp256k1 (the Bitcoin curve). They are NOT interchangeable.
Signing without a fresh nonce. Never reuse ECDSA nonces — see the ECDSA nonce reuse FAQ. Every library handles this correctly; do not roll your own.
Losing the private key. Unlike a shared HMAC secret, an ECDSA private key cannot be re-derived. Back it up encrypted in a secrets manager; if you lose it you must rotate to a new key and reissue all tokens.
Confusing SPKI and PKCS8 formats. SPKI is the public key format (-----BEGIN PUBLIC KEY-----). PKCS8 is the private key format (-----BEGIN PRIVATE KEY-----). Some tools also produce SEC1 format (-----BEGIN EC PRIVATE KEY-----); convert with openssl pkcs8 -topk8 -nocrypt -in sec1.pem -out pkcs8.pem.

Generating an ES256 Keypair

# OpenSSL — most portable
openssl ecparam -genkey -name prime256v1 -noout -out private.pem
openssl ec -in private.pem -pubout -out public.pem

# Node.js
const { generateKeyPairSync } = require('crypto');
const { publicKey, privateKey } = generateKeyPairSync('ec', {
  namedCurve: 'P-256',
  publicKeyEncoding:  { type: 'spki',  format: 'pem' },
  privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
});

# Python
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import serialization
private_key = ec.generate_private_key(ec.SECP256R1())
private_pem = private_key.private_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PrivateFormat.PKCS8,
    encryption_algorithm=serialization.NoEncryption(),
)

Related JWT Tools

JWT RS256 Decoder — RSA-signed JWTs
JWT HS256 Decoder — symmetric HMAC variant
Verify JWT Signature — universal signature verifier
JWT Decoder Online — decode any JWT algorithm
Hash Generator — compute SHA-256 for JWT signing input

What Makes ES256 the Modern JWT Default

Real-World ES256 Deployments

Apple Sign in with Apple — id_tokens returned by Apple are signed with ES256. You verify them using the public keys published at appleid.apple.com/auth/keys.
Apple Push Notification service (APNs) — provider authentication uses ES256 JWTs (called "provider authentication tokens") signed with a key downloaded from your Apple Developer account.
App Store Server API — subscription and transaction endpoints require ES256 JWTs signed with your Apple Developer team key.
WebAuthn / FIDO2 — many authenticators produce ES256 attestation signatures that are wrapped as JWTs when transmitted server-to-server.
DPoP (Demonstrating Proof of Possession, RFC 9449) — the modern OAuth 2.0 sender-constrained access token proof uses ES256 by default.

Signing and Verifying ES256 in Every Major Language

Node.js — jose (recommended)

import { SignJWT, jwtVerify, importPKCS8, importSPKI } from 'jose';

// Sign
const privateKey = await importPKCS8(pkcs8Pem, 'ES256');
const jwt = await new SignJWT({ sub: '12345' })
  .setProtectedHeader({ alg: 'ES256' })
  .setIssuedAt()
  .setExpirationTime('1h')
  .sign(privateKey);

// Verify
const publicKey = await importSPKI(spkiPem, 'ES256');
const { payload } = await jwtVerify(jwt, publicKey, {
  algorithms: ['ES256'],
});

Python — PyJWT + cryptography

import jwt
from cryptography.hazmat.primitives import serialization

# Load keys
with open("private.pem", "rb") as f:
    private_key = serialization.load_pem_private_key(f.read(), password=None)
with open("public.pem", "rb") as f:
    public_key = serialization.load_pem_public_key(f.read())

# Sign
token = jwt.encode({"sub": "12345"}, private_key, algorithm="ES256")

# Verify
payload = jwt.decode(
    token,
    public_key,
    algorithms=["ES256"],
)

Go — golang-jwt/jwt

import (
    "crypto/ecdsa"
    "github.com/golang-jwt/jwt/v5"
)

// Sign
token := jwt.NewWithClaims(jwt.SigningMethodES256, jwt.MapClaims{
    "sub": "12345",
    "exp": time.Now().Add(time.Hour).Unix(),
})
tokenString, err := token.SignedString(ecPrivateKey) // *ecdsa.PrivateKey

// Verify
parsed, err := jwt.Parse(tokenString, func(t *jwt.Token) (any, error) {
    if _, ok := t.Method.(*jwt.SigningMethodECDSA); !ok {
        return nil, fmt.Errorf("unexpected alg")
    }
    return ecPublicKey, nil  // *ecdsa.PublicKey
})

Java — jjwt

import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.spec.ECGenParameterSpec;

// Generate ES256 keypair
KeyPairGenerator kpg = KeyPairGenerator.getInstance("EC");
kpg.initialize(new ECGenParameterSpec("secp256r1"));
KeyPair kp = kpg.generateKeyPair();

// Sign
String jws = Jwts.builder()
    .setSubject("12345")
    .signWith(kp.getPrivate(), SignatureAlgorithm.ES256)
    .compact();

// Verify
Claims claims = Jwts.parserBuilder()
    .setSigningKey(kp.getPublic())
    .build()
    .parseClaimsJws(jws)
    .getBody();

ES256 Signature Format — Raw vs DER

Common ES256 Pitfalls

DER-encoded signature. Result: verification fails everywhere. Use a proper JWT library, not raw crypto.sign("ecdsa").
Using the wrong curve. ES256 is P-256 only. Signing with P-384 (that's ES384) or secp256k1 (that's ES256K, a non-standard extension used by blockchains) will not interoperate.
Confusing ES256 with ES256K. ES256 uses NIST P-256; ES256K uses secp256k1 (the Bitcoin curve). They are NOT interchangeable.
Signing without a fresh nonce. Never reuse ECDSA nonces — see the ECDSA nonce reuse FAQ. Every library handles this correctly; do not roll your own.
Losing the private key. Unlike a shared HMAC secret, an ECDSA private key cannot be re-derived. Back it up encrypted in a secrets manager; if you lose it you must rotate to a new key and reissue all tokens.
Confusing SPKI and PKCS8 formats. SPKI is the public key format (-----BEGIN PUBLIC KEY-----). PKCS8 is the private key format (-----BEGIN PRIVATE KEY-----). Some tools also produce SEC1 format (-----BEGIN EC PRIVATE KEY-----); convert with openssl pkcs8 -topk8 -nocrypt -in sec1.pem -out pkcs8.pem.

Generating an ES256 Keypair

# OpenSSL — most portable
openssl ecparam -genkey -name prime256v1 -noout -out private.pem
openssl ec -in private.pem -pubout -out public.pem

# Node.js
const { generateKeyPairSync } = require('crypto');
const { publicKey, privateKey } = generateKeyPairSync('ec', {
  namedCurve: 'P-256',
  publicKeyEncoding:  { type: 'spki',  format: 'pem' },
  privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
});

# Python
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import serialization
private_key = ec.generate_private_key(ec.SECP256R1())
private_pem = private_key.private_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PrivateFormat.PKCS8,
    encryption_algorithm=serialization.NoEncryption(),
)

Related JWT Tools

JWT RS256 Decoder — RSA-signed JWTs
JWT HS256 Decoder — symmetric HMAC variant
Verify JWT Signature — universal signature verifier
JWT Decoder Online — decode any JWT algorithm
Hash Generator — compute SHA-256 for JWT signing input

JWT ES256 Decoder — ECDSA P-256 In-Browser

What Makes ES256 the Modern JWT Default

Real-World ES256 Deployments

Signing and Verifying ES256 in Every Major Language

Node.js — jose (recommended)

Python — PyJWT + cryptography

Go — golang-jwt/jwt

Java — jjwt

ES256 Signature Format — Raw vs DER

Common ES256 Pitfalls

Generating an ES256 Keypair

Related JWT Tools

Frequently Asked Questions

JWT ES256 Decoder — ECDSA P-256 In-Browser

What Makes ES256 the Modern JWT Default

Real-World ES256 Deployments

Signing and Verifying ES256 in Every Major Language

Node.js — jose (recommended)

Python — PyJWT + cryptography

Go — golang-jwt/jwt

Java — jjwt

ES256 Signature Format — Raw vs DER

Common ES256 Pitfalls

Generating an ES256 Keypair

Related JWT Tools

Frequently Asked Questions