OpenID Connect Core requires providers to support RS256 for ID tokens, which is why Google, Microsoft Entra ID, Okta and Auth0 sign with it by default. Keys must be at least 2048 bits (RFC 7518 §3.3); the JWK has kty RSA, n and e. Signatures are deterministic: the same key and input always give the same output.
Verification is cheap (about 114,000 per second for 2048-bit keys on one Apple M4 Max core with OpenSSL 3.6.5) and signing is slow (about 3,000 per second), which suits issuers that sign far less often than relying parties verify. The cost is size: a 2048-bit signature is 342 base64url characters, a 3072-bit one 512.
The classic pitfall is algorithm confusion: a verifier that also accepts HS256 with the same key object can be tricked into using the RSA public key as an HMAC secret. Pin RS256 per key. PS256 uses the same keys with the stronger PSS padding.