# HMAC-SHA256 vs HMAC-SHA512 for JWT API authentication

Which algorithm is recommended to use when encoding / decoding JWT web application tokens? Is using HMAC-SHA256 enough or would using HMAC-SHA512 provide more security? And on 64bit machines, is it true that HMAC-SHA512 is faster than HMAC-SHA256?

• @W.M. There is no maximum. A hash doesn't store data, it just hashes data to a computationally unique value, indistinguishable from random (to one not knowing the input data - of course). Well, officially there are limits to the input, but even the smaller hashes are limited to $2^{64}$ bits (more than \$10^{18} bytes), so the limit is out of reach for any kind of standard computer even to calculate. To give some more of an idea see the answer here – Maarten Bodewes May 5 '18 at 12:26