---
author: Jan Brennenstuhl
canonical_url: https://www.janbrennenstuhl.eu/jwa/
description: JSON Web Algorithms (JWA) power all JWT use cases. Learn how to decode JWA short names, what algorithms there are and why JWA matters for OpenID Connect.
id: jb-jwa
kind: essay
license:
name: CC BY 4.0
scope: Original text; credited third-party media retain their own rights.
url: https://creativecommons.org/licenses/by/4.0/
markdown_url: https://www.janbrennenstuhl.eu/jwa/index.md
modified: '2025-06-22T00:00:00+02:00'
published: '2023-06-08T00:00:00+02:00'
review_basis: publication
review_status: reviewed
reviewed: '2023-06-08'
series: jwt
status: published
title: What is JWA? A Deep Dive into JSON Web Algorithms
topics:
- tokens-jwt
---
# What is JWA? A Deep Dive into JSON Web Algorithms
Algorithms for Modern Identity & Access Management (IAM)
## Definition of JWA
*JSON Web Algorithms (JWA)* is a specification providing a list of cryptographic algorithms. It's an integral part of the *JSON Object Signing and Encryption (JOSE)* family of standards. JOSE includes, for example, *JSON Web Tokens (JWT)*, *JSON Web Signature (JWS)*, and *[JSON Web Encryption (JWE)](https://www.janbrennenstuhl.eu/jwe/ "An Exploration into JSON Web Encryption Standards (JWE)")*.
JWA provides definitions for several cryptographic algorithms. These algorithms enable various purposes.
In this guide, you’ll learn the following:
- How to decode JWA short names
- What JWAs there are
- Why JWA matters for OpenID Connect
## Anatomy of JSON Web Algorithms
The JWA specification defines a unique name for every algorithm. These names are short strings encoding the particular algorithm family and hashing algorithm. Variants for SHA-256, SHA-384, and SHA-512 exist for most signing algorithms.
The most common algorithm names defined in the JWA specification include the following:
| Algorithm Name | Algorithm Description |
|----------|-------------------------------------|
| HS256 | HMAC with SHA-256 |
| RS256 | RSA signature with SHA-256 |
| ES256 | ECDSA using P-256 and SHA-256 |
| RSA-OAEP | RSAES OAEP using default parameters |
| A128KW | AES key wrap with 128-bit key |
{.table-striped}
[RFC 7518](https://datatracker.ietf.org/doc/html/rfc7518 "RFC: JSON Web Algorithms (JWA)") defines the fundamental base JSON Web Algorithms. The [JOSE IANA registry](https://www.iana.org/assignments/jose/jose.xhtml#web-signature-encryption-algorithms "JSON Web Signature and Encryption Algorithms") provides a complete list of supported algorithms. These unique references allow receivers to identify the correct cryptographical procedure. They are part of the JOSE header.
## Different Types of JSON Web Algorithms
The JWA specification defines many cryptographic algorithms powering various use cases, including:
- **Signing with JSON Web Signature (JWS)** ensures a token's integrity during transit.
- **Encryption with JSON Web Encryption (JWE)** to safeguard the confidentiality of token payload.
- **Distribution with JSON Web Keys (JWK)** to enable distributed JWT validation.
All JSON Web Algorithms are either symmetric or asymmetric.
### Understanding the Symmetric Key Algorithms
Hash-Based Message Authentication Codes (HMAC) are a popular algorithm class for signed JWTs. HMACs like HS256 provide a way of signing messages using a shared key. They belong to the family of symmetric cryptographic algorithms.
Symmetric algorithms need all involved parties to know the same key. They are helpful when all clients can guarantee the secrecy of the shared key. Their permissive nature allows all key possessors to create and verify JWTs. HMACs are best used in setups with one central issuer/ verifier.
### Delving into Asymmetric Key Algorithms
JWA specifies two asymmetric encryption and digital signature algorithm families – RSA and ECDSA. Public-private key pairs form the foundation of asymmetric algorithms. They enable decoupling verification or decryption of a token from being able to forge a new one. This is essential for distributed token validation scenarios. It allows decentralized authorization decision-making in OAuth 2.0 and OpenID Connect (OIDC).
## Practical Applications of JWA
A widespread use case is decentralized token signature verification for asymmetrically signed JWT. It's a key enabler for OpenID Connect.
At the forefront of this practical application is a central authorization server. This token issuer holds a private signing key and exposes its public key material. Clients in need to verify tokens fetch the public keys from the [well-known JWK endpoint](https://www.janbrennenstuhl.eu/jwks/ "JSON Web Key Sets Explained"). Based on cryptographic meta information carried in the JWT header, clients identify the matching key and JWA. This way, relying parties can verify a token's integrity without the need for centralized introspection.
## Conclusion
JWA is part of the JSON Web Token (JWT) suite of technologies. It's a collection of cryptographic algorithms. Being a vital ingredient of every JWT, JWA powers the entire JOSE toolbox. These JOSE technologies build secure systems that can interoperate easily. OpenID Connect is a famous example of such a framework.
Please note that each JSON Web Algorithm has its security implications. Appropriate use cases depend on the specifics of the implementation. It is paramount to choose algorithms that best meet your specific security requirements.
---
Cite as: Jan Brennenstuhl. "What is JWA? A Deep Dive into JSON Web Algorithms." Brennenstuhl on Security, 8 June 2023. https://www.janbrennenstuhl.eu/jwa/
License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) for the original text; credited third-party media keep their own rights.