JWK Thumbprint

Compute the RFC 7638 thumbprint of a JSON Web Key — the canonical, hash-based identifier used to name a key (DPoP jkt bindings, ACME account-key thumbprints per RFC 8555, DBSC session pins, and kid derivation). The thumbprint is base64url(SHA-256(canonical-JSON)), where the canonical JSON contains only the key-type's required members, with member names in lexicographic order and no whitespace — so the same key always produces the same thumbprint regardless of how its JWK was serialized.

thumbprint(jwk) returns the base64url digest; canonicalize(jwk) returns the exact JSON string that is hashed. The standard key types are supported — EC, RSA, oct, and OKP (RFC 8037 Ed25519 / X25519) — plus AKP, the IANA key type Node uses for ML-DSA / SLH-DSA post-quantum public keys. SHA-256 is the default; hash: "sha384" | "sha512" selects a longer digest (RFC 9278 thumbprint-with-hash).

b.jwk.canonicalize(jwk) #

Return the RFC 7638 canonical JSON string for a JWK — only the key-type's required members, member names in lexicographic order, no whitespace. This is the exact input that thumbprint hashes. Throws JwkError for a missing kty, an unsupported key type, or a missing required member.

b.jwk.canonicalize({ kty: "EC", crv: "P-256", x: "...", y: "...", use: "sig" });
// → '{"crv":"P-256","kty":"EC","x":"...","y":"..."}'  (use omitted)

b.jwk.thumbprint(jwk, opts?) #

{
  hash:   "sha256" | "sha384" | "sha512",   // default: "sha256"
}

Compute the RFC 7638 thumbprint of a JWK: base64url(hash(canonicalJSON)). Only the key-type's required members feed the hash, so optional fields (kid, use, alg, …) never change the result. SHA-256 is the default digest; hash selects a longer one. Throws JwkError on an invalid JWK or unknown hash.

b.jwk.thumbprint({ kty: "RSA", e: "AQAB", n: "0vx7ago...DKgw" });
// → "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"

Last updated 2026-08-08T16:39:49.652Z by seeder.