Construct the exact bytes
02Semantically similar JSON can have different bytes. Thumbprints require the specified member order and representation before hashing.
All characters in this example are ASCII, so each is one UTF-8 byte. The initial bytes 7b 22 6b 22 3a 22 encode {, quote, k, quote, colon, quote. Hash these JSON bytes, not a hex dump.
Source for this drawing: RFC 7638 · Read RFC section 3.3 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- Canonical representation
- A precisely specified spelling of the selected data.
- UTF-8
- The encoding that turns the serialized Unicode string into octets for hashing.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Order member names lexicographically by Unicode code points and omit whitespace before or after syntactic elements. The oct key type selects k then kty.
- Order member names lexicographically by Unicode code points and omit whitespace before or after syntactic elements. The oct key type selects k then kty.
- Represent characters in member names and values without escapes (MUST). Thumbprints needing characters that JSON requires to be escaped are not defined by this RFC.
- If a key type defines object-valued required members, recursively order their members (MUST). Integer-valued members MUST omit fraction and exponent parts; noninteger cases are not defined here.
- UTF-8 encoding follows serialization. JSON.stringify does not itself guarantee sorting; Unicode code point ordering must not be replaced by locale-sensitive collation.
This chapter uses the deliberately insecure public toy octet key AQID, meaning bytes 01 02 03, only to show an entire short serialization. Do not use it as a real secret. The exact JSON string contains 24 ASCII characters/UTF-8 bytes; display quotes belong to JSON, while the diagram captions and byte annotations do not. RFC 7638 is not a general JSON canonicalization scheme. Future key-type representations must follow their own definitions and this RFC’s Unicode restrictions.
Read the RFC section ↗