All tools

JWK Thumbprint Calculator

JWT

Compute the RFC 7638 thumbprint of a JSON Web Key: canonicalize its required members and hash them with SHA-256, SHA-384, or SHA-512.

A JWK thumbprint is the canonical fingerprint defined by RFC 7638: hash only a key's required members, sorted alphabetically with no whitespace, so any two implementations that parse the same key produce the identical value. It's how OpenID Connect derives a stable key ID, how DPoP and mutual-TLS bind a token to a specific public key, and how you can confirm two JWKS entries actually describe the same key without comparing the full JSON byte for byte. This tool builds that canonical JSON for RSA, EC, oct, and OKP keys and hashes it with SHA-256, SHA-384, or SHA-512, showing the exact bytes that went into the hash so you can verify the canonicalization yourself. It's distinct from the JWK Viewer, which inspects a key's metadata rather than computing its identifying hash.

jwkjwksthumbprintrfc7638sha256oauthoidcfingerprintdpop

How to use JWK Thumbprint Calculator

  • 1.Paste a single JWK object, not a JWKS set with a keys array.
  • 2.Pick a hash algorithm: SHA-256 is the default and what most specs (OIDC, DPoP) expect.
  • 3.Read the thumbprint, plus the canonical JSON it was computed from, so you can verify the canonicalization yourself.

Frequently asked questions

What is a JWK thumbprint used for?
It's a stable identifier for a public key, used as a key ID in OpenID Connect, to bind an access token to a key in DPoP and mutual-TLS, and to check whether two JWKS entries describe the same key.
Why does it only use some of the JWK's fields?
RFC 7638 defines a fixed, minimal member set per key type (e, kty, n for RSA; crv, kty, x, y for EC) specifically so optional fields like alg, kid, or use don't change the fingerprint of the same underlying key.
Can I compute a thumbprint for a JWKS set with multiple keys?
No, RFC 7638 thumbprints are defined per key. Paste one JWK object at a time; use the JWK Viewer first if you need to split a JWKS set apart.
Which key types are supported?
RSA, EC, oct (symmetric), and OKP (the Ed25519/X25519 family from RFC 8037). An unrecognized kty is rejected rather than guessed at.

Use via API, SDK, or MCP

cURL# Free: 1,000 req/day · Pro: 10,000 req/day
curl -X POST https://api.utilix.tech/v1/tools/jwk-thumbprint \
  -H "Authorization: Bearer utx_live_..." \
  -H "Content-Type: application/json" \
  -d '{"input":"{\"kty\":\"RSA\",\"n\":\"0vx7...\",\"e\":\"AQAB\"}","hashAlg":"SHA-256"}'

Get an API key from your dashboard · Full API docs →

Related tools

JWK ViewerParse a JSON Web Key Set (JWKS) or a single JWK and view each key's type, use, algorithm, key ID, and size in a readable tableJWTHash GeneratorMD5, SHA-1, SHA-256, SHA-512 and moreHash