ES384: ECDSA with P-384 and SHA-384 in a JWT
ES384 signs with an elliptic curve key on P-384 using SHA-384, producing a 96 byte signature. It is the step up from ES256 and appears mostly where a policy names a 192 bit security level.
At a glance
- Algorithm
- ES384, ECDSA using P-384 and SHA-384
- Registered in
- RFC 7518 section 3.4
- Implementation requirement
- Optional
- Key
- Elliptic curve key pair on P-384, also known as secp384r1
- Signature size
- 96 bytes, R and S at 48 bytes each, 128 base64url characters
- Verified in the decoder
- Yes, in your browser, with a PEM public key. P-384 is selected from the algorithm name.
In detail
The curve and the hash move together in the ES family, so ES384 means P-384 with SHA-384 and nothing else. R and S are 48 bytes each and are concatenated raw, giving a 96 byte signature and 128 base64url characters in the token. That is still well under half the size of an RS256 signature on a 2048 bit key.
Where it shows up is telling. National and sector standards that specify a 192 bit security level name P-384 explicitly, so government adjacent systems and some payment infrastructure use it while general web deployments stay on P-256. Hardware security modules and secure elements very often support both curves, which makes the upgrade cheap when a policy demands it.
Performance is a real difference rather than a rounding error. P-384 arithmetic is materially slower than P-256, both to sign and to verify, and unlike RSA the cost falls on the verifier too. For an API validating a token on every request that is worth measuring before adopting it as a default, especially where the same request already does several other cryptographic operations.
The decoder verifies ES384 in the browser from a PEM public key. The same DER against raw signature trap as ES256 applies: the expected third part is 128 base64url characters, and anything else usually means the signature is still in the structured encoding a general purpose library produced.
Examples
ES256 P-256 R and S 32 bytes each 64 bytes 86 base64url characters
ES384 P-384 R and S 48 bytes each 96 bytes 128 base64url characters
ES512 P-521 R and S 66 bytes each 132 bytes 176 base64url charactersCounting the characters in the third part of a token identifies which ES variant produced it.
Things that catch people out
- Mixing the curve and the hash, for instance P-384 with SHA-256. The pairing is fixed by the algorithm name and a mismatch is not valid ES384.
- Padding R or S to the wrong width. Each is exactly 48 bytes here, including leading zeros.
- Adopting P-384 by default without measuring. Verification is slower than P-256 and that cost lands on every API request.
Try it: JWT Decoder
Paste a token to decode the header and payload, read the claims and expiry, and verify the signature in your browser. Nothing is uploaded.
JWT Decoder
LOCAL · Browser-OnlyDecode and inspect JSON Web Tokens without sending them to a server
Related JWT claims and algorithms
All jwt claims and algorithms →ES256: ECDSA with P-256 and SHA-256 in a JWT
ES256 signs a JWT with ECDSA on curve P-256 using SHA-256. Signature format, why raw R and S beats DER here, and verifying with a public key.
ES512: ECDSA with P-521 and SHA-512 in a JWT
ES512 signs a JWT with ECDSA on curve P-521 using SHA-512. Why the curve is 521 bits, what that does to signature length, and how to verify it.
PS384: RSASSA-PSS with SHA-384 in a JWT
PS384 signs a JWT using RSA-PSS with SHA-384 and a 48 byte salt. What changes against PS256, and how the decoder verifies one in your browser.
EdDSA: Edwards-curve Signatures in a JWT
EdDSA signs a JWT with Ed25519 or Ed448 under the OKP key type. What RFC 8037 defines, why it is deterministic, and why the decoder cannot verify it.
none: The Unsecured JWT Algorithm
The none algorithm means a JWT carries no signature at all. How the alg none attack works, what to configure, and how the decoder handles such a token.
alg (Algorithm) Header Parameter in a JWT
The alg header names the algorithm used to sign a JWT. Why the accepted algorithms belong in configuration, and what the decoder does with the value.
Tools for this
- JWT Decoder Free online JWT decoder - decode and inspect JSON Web Tokens without sending them to a server