# JWT Works on which mechanism?

**URL:** <https://community.auth0.com/t/jwt-works-on-which-mechanism/10099>\
**Category:** JWT.io\
**Created:** [March 15, 2018, 10:09am UTC](https://community.auth0.com/t/jwt-works-on-which-mechanism/10099 "2018-03-15T10:09:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![priyanshu992](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@priyanshu992](https://community.auth0.com/u/priyanshu992)\
**Post date:** [March 15, 2018, 10:09am UTC](https://community.auth0.com/t/jwt-works-on-which-mechanism/10099/1 "2018-03-15T10:09:22Z")

</div>

Does JWT work on shared key mechanism or public -private key mechanism ??

Suppose I have a content which i encrypt with JWT on Node.js but i want to decrypt this content on shell script ? Is this possible with JWT… if yes how can we do this

---

<div class="post-metadata">

**Author:** ![richard.dowinton](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/richard.dowinton/32/16150_2.png) [@richard.dowinton](https://community.auth0.com/u/richard.dowinton)\
**Post date:** [March 16, 2018, 3:56pm UTC](https://community.auth0.com/t/jwt-works-on-which-mechanism/10099/2 "2018-03-16T15:56:50Z")

</div>

JWT can work with either.

You can use HS256 that makes use of a symmetrical (i.e., shared) key. Auth0 uses the client secret as the key in this case.

RS256 in contrast uses public key encryption (i.e., public/private key pair), and is the ideal choice given the key used to sign the token is kept secret.

[This article](https://auth0.com/blog/navigating-rs256-and-jwks/) explains in detail how RS256 signed tokens work and how you can verify them with the JWKS endpoint. It includes examples in Node.js, so it should give you a good idea of how to implement it in your application.

You can check the `alg` property of the JWT to determine which algorithm your JWT uses as described [here](https://auth0.com/docs/api-auth/tutorials/verify-access-token#check-the-signature-algorithm)

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [July 25, 2019, 11:09am UTC](https://community.auth0.com/t/jwt-works-on-which-mechanism/10099/3 "2019-07-25T11:09:04Z")

</div>


