Paste an RSA, EC, OKP, or symmetric JSON Web Key to calculate its RFC 7638 SHA-256 thumbprint, or generate a temporary public example with Web Crypto.
Generated examples export only the public JWK. Production private keys belong in a dedicated key-management system.
SHA-256 with unpadded Base64url output
A JSON Web Key (JWK) represents cryptographic key material as JSON. RFC 7638 defines a stable thumbprint by selecting the required public members for the key type, serializing those members in lexicographic order without extra whitespace, hashing the UTF-8 bytes, and encoding the digest with unpadded Base64url.
Extra metadata such as kid, use, alg, or an X.509 certificate chain does not affect the thumbprint. For an RSA public key, only e, kty, and n are included. EC keys use crv, kty, x, and y. OKP keys use crv, kty, and x under their defining specification.
JWK thumbprints are used by ACME account key authorizations, proof-of-possession systems, key registries, and configuration checks that need a stable identifier for the key itself. They are not signatures and do not prove that a party possesses the private key.
The generator can create a temporary RSA-2048 or P-256 key pair through the browser Web Crypto API and export only the public JWK. The private key is not displayed or stored by this page. Use a dedicated key-management system for production keys.
The calculator verifies that required members exist and use Base64url characters, then applies SHA-256. It does not prove that coordinates lie on a named curve, that an RSA modulus is cryptographically strong, that an algorithm label matches the key, or that a certificate is valid.
Calculating a thumbprint for a symmetric oct key necessarily hashes secret key material. Do not paste production secrets into tools you do not trust, even though this MiniUtil implementation runs locally. Prefer public-key JWKs where possible.
Inspect related token data with the JWT Decoder, create OAuth proof-key values with the PKCE Generator, or calculate ordinary digests with the Hash Generator.
JWK input and generated keys stay in the browser and are not sent to MiniUtil. Analytics records only coarse tool actions, never key material.
The canonicalization and hashing procedure comes from RFC 7638. JWK member definitions are in RFC 7517 and RFC 7518.
Share this utility
Send the tool, not any text or files you entered. Input is never added to the share URL.
Keep working