HS256 Signing

HS256 = HMAC with SHA-256. Symmetric: same key signs and verifies.

signing_input = base64url(header) + "." + base64url(payload)
signature     = HMAC-SHA256(secret_key, signing_input)
jwt           = signing_input + "." + base64url(signature)

Verification:

1. Split JWT on dots into 3 parts.
2. Recompute HMAC-SHA256 over header.payload.
3. Compare to the decoded signature.
4. Use constant-time comparison to avoid timing attacks.

Pros: simple, fast, small keys (32+ bytes random). Cons: anyone with the verification key can ALSO sign new tokens. Bad for cross-organization scenarios where the verifier shouldn't be able to forge.

For those: use RS256 or ES256 (asymmetric — covered next).