HS256 is the JWT algorithm identifier for HMAC using SHA-256. It creates a signature from the base64url-encoded header and payload, joined by a dot, and a secret key. The signature provides integrity and authenticity: changing the token makes verification fail. section 7.2.2
HS256 is symmetric: the same secret signs and validates tokens. Every verifier therefore needs the signing key, increasing the risk of key exposure. Keep the key out of source code and obtain it from the environment or another protected configuration source. section 8.2
Issuing an HS256 token with PyJWT
A Python service can supply a payload, signing key, and algorithm to PyJWT: jwt.encode(payload=payload, key="password", algorithm="HS256"). The example includes issuer, subject, audience, issued-at, and one-hour expiration claims. The hardcoded password is illustrative; production code should retrieve the secret from the environment. section 8.2
HS256 does not hide JWT claims. Because the header and payload are base64url-encoded JSON, token holders can inspect them. Use token encryption when the claims are sensitive; JWE provides a standard encrypted-token format. section 7.2.2
