Reproduce the official RSA example
03The published RSA example gives a complete known result. Reproducing it catches wrong member selection, ordering, byte encoding and digest formatting.
The 32 digest bytes encode to the exact 43-character base64url value, with no equals padding. Encoding the hex characters instead would produce the wrong result.
Source for this drawing: RFC 7638 · Read RFC section 3.1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- RSA modulus
- The public integer n, represented as an unpadded base64url unsigned integer in the JWK.
- Base64url
- An encoding using URL-safe characters; this example omits padding.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The official input JWK has kty RSA, n, e AQAB, alg RS256 and kid 2011-04-29. Only e, kty and n enter the computation.
- The official input JWK has kty RSA, n, e AQAB, alg RS256 and kid 2011-04-29. Only e, kty and n enter the computation.
- Serialize e, kty, n in that order without extra whitespace. The entire n value is included; the displayed row breaks are only for readability.
- The example chooses SHA-256. Its 32-byte digest is then represented with base64url without padding; base64url encodes the digest, not the original JWK.
- RS256 in the original alg member describes an intended key algorithm. It neither enters this hash input nor selects the thumbprint hash automatically.
Use the RFC’s full n value and corresponding compact JSON, not a shortened prefix, a diagram label or line breaks. The example is public test data, not a key to trust. The diagram shows the entire 342-character modulus in consecutive rows; join those rows without spaces. Published output NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs is an identifier, not proof of possession.
Read the RFC section ↗