It is my understanding that HMAC is a symmetric signing algorithm (single secret key) whereas RSA is an asymmetric signing algorithm (private/public key pair). I am trying to choose between these 2 methods for signing JSON Web Tokens.

However, I am a little bit confused about the use case of HMAC. If both the clients (users) and the server share a key, what is stopping the client from changing the token's payload fields (perhaps the subject to another user's id) and then resigning the token client-side. Clearly this would be bad. Does HMAC only guarantee that the data was signed by someone with the secret key, and not just a single entity as with RSA? What use case does this actually have, perhaps I am misunderstanding something? Or perhaps the secret key isn't even shared with clients at all?


HMAC is used to protect against manipulation by someone who has not access to the secret. Typically this means to protect against manipulation by the client if the secret is only known to the server or to protect against manipulation in transit if the secret is known to client and server.

An RSA based signature is used to protect against manipulation and also to allow others to verify the integrity and source of the data without being able to manipulate the data. This can be done because the private key is only known to the provider and signer of the data while the public key is known to everybody who likes to verify the integrity.

What to choose thus depends on your specific use case. If the server just needs to protect the token against manipulation by the client then using HMAC with a server side secret is enough. If instead it needs to be also proven to others that the token was created by a specific (trusted) server then RSA based signatures should be used.

  • But doesn't the knowledge of a shared secret have a similar function to a RSA signature? E.g. if I tell Bob's server a shared secret X, and I receive a JWT with a HMAC with key X, then I know Bob created it. Or am I wrong in this assumption? – MechMK1 Oct 25 '19 at 11:34
  • 1
    @MechMK1: Depends how many have the shared secret. With HMAC everybody having the shared secret can verify the integrity but also modify the data, which means that it cannot really be used as proof of origin of more than 2 parties are involved (which also means that the secret needs to be protected in transit between these two parties). With RSA signature everybody having the public key can verify the signature but only the one having the private key can create it. – Steffen Ullrich Oct 25 '19 at 11:51
  • Yes, that's true. I don't know in which scenarios JWT's would be used in such a manner, but I understand the point behind it. – MechMK1 Oct 25 '19 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.