“JSON Web Key (JWK) Thumbprint,” for which Mike Jones and I are credited as co-authors, has been published as [RFC 7638].
This specification defines a method for calculating a stable hash value for a JSON Web Key (JWK). Specifically, it describes which JWK fields are used to calculate the hash value, how those fields are normalized, how the resulting Unicode string is converted to a byte sequence, and how the hash value is obtained from that byte sequence. The resulting hash value can be used to identify and select a JWK that contains the key in question.
I would like to express my deep gratitude to James Manger, John Bradley, Mike Jones, who once again made tremendous contributions, and everyone who participated in reviewing the security aspects of this specification. I would also like to thank everyone in the JOSE working group, its chairs, the Area Directors, and everyone at the IETF who was involved in developing this specification.
I should also note that this JWK Thumbprint is used as the value of the “sub” (subject) claim in an OpenID Connect self-issued ID Token.
[RFC 7638] Jones, M., N. Sakimura:JSON Web Key (JWK) Thumbprint, (2015/9), https://tools.ietf.org/html/rfc7638
Related posts
Happy New Year
Thank you very much for all your support during the past year. In 2015, almost as though marking my 50th birthday, a succession of standards on…
Celebrating RFC 9901! SD-JWT Becomes an Internet Standard — A New Rule for the Digital ID Wallet Era: “Show Only What Is Necessary” — An Overview of SD-JWT, the Core Format Supporting Verifiable Credentials and Identity Wallets
1. The Birth of RFC 9901 On November 19, 2025, the specification defining “Selective Disclosure for JSON Web Tokens,” commonly known as SD-JWT (pronounced “ess-dee-jot”), was…
OAuth PKCE Published as RFC7636
OAuth PKCE (pronounced “pixy”), for which John Bradley (Ping), Naveen Agarwal (Google), and I are credited as co-authors, has been published as [RFC 7636]. It was…