A JWS signature is the two 32-byte big-endian integers r and s, concatenated and base64url-encoded (86 characters). Signing with OpenSSL, Java's default SHA256withECDSA, Go's ecdsa.SignASN1 or Node's default crypto.sign() produces DER instead, which verifiers reject; request IEEE P1363 output or convert. The key is an EC JWK with crv P-256.
ES256 is the default for passkeys (COSE −7), DPoP proofs, Apple's App Store Connect and APNs provider tokens, and many modern identity providers, because P-256 is supported by browsers' WebCrypto, Secure Enclave, TPMs and cloud KMS. Signing is fast (about 87,000 signatures per second with OpenSSL 3.6.5 on one Apple M4 Max core) and tokens are about 250 characters shorter than RS256 ones with 2048-bit keys.
A sharp lesson from 2022: Java 15 to 18 accepted an all-zero ECDSA signature for any message and key (CVE-2022-21449, "Psychic Signatures"), so forged ES256 JWTs passed verification. Keep runtimes patched and make sure verifiers reject r or s outside 1…n−1.