RS256 vs ES256: RSA or elliptic curve signatures for your JWTs

How this is calculated

Size is the most visible difference. An ES256 signature is two 32-byte numbers, r and s, for 64 bytes, or 86 Base64url characters. An RS256 signature with a 2048-bit key is 256 bytes, or 342 characters. That gap matters when tokens travel in cookies or headers on every request. Key generation and signing are quick with ECDSA, while RSA verification is very cheap, so a busy API that only verifies won't feel much difference. ECDSA has sharper edges. Each signature needs a fresh random or deterministic nonce, and a repeated nonce leaks the private key. JWS also writes the signature as raw r and s, not the DER format many crypto libraries produce, so a hand-built signer can create tokens that other libraries reject. A verifier needs care too: in 2022 a Java bug known as Psychic Signatures accepted an ECDSA signature of all zeros. RSA's pitfalls are mostly about key size, since RFC 7518 requires at least 2048 bits. ES384 and ES512 use the P-384 and P-521 curves with 96 and 132 byte signatures, and they're rarely needed for tokens.

Verdict

Pick ES256 for new systems that control both ends and care about token size, like mobile apps and cookies. Pick RS256 when you need every language, gateway and identity provider to work out of the box. Either way, keep libraries patched and let the library build the signature format.