Show SHA-256 hash Show key sort diff

Features

📐 RFC 8785 Compliant

Recursive key sorting (lexicographic)
Whitespace removal
Deterministic output
Handles nested objects and arrays

🔐 SHA-256 Hash

Web Crypto API (native browser)
Hex-encoded digest output
Suitable for payload signing
Repeatable across platforms

🔍 Key Sort Diff

Shows keys that were reordered
Count of total keys processed
Detects already-sorted payloads
Useful for debugging JWS/JWK

RFC 8785 Guide

What is JSON Canonicalization?

RFC 8785 (JSON Canonicalization Scheme, JCS) defines a deterministic serialization format for JSON. It enables consistent hashing and signing of JSON payloads regardless of how the original JSON was formatted.

// Input (any order, any whitespace)
{
  "zebra": "last",
  "apple": "first"
}

// Canonical form (RFC 8785)
{"apple":"first","zebra":"last"}

Using Canonical JSON for Signing

// Node.js example
const crypto = require('crypto');

function canonicalize(val) {
    if (val === null || typeof val !== 'object') return JSON.stringify(val);
    if (Array.isArray(val)) return '[' + val.map(canonicalize).join(',') + ']';
    const sorted = Object.keys(val).sort();
    return '{' + sorted.map(k => JSON.stringify(k) + ':' + canonicalize(val[k])).join(',') + '}';
}

const canonical = canonicalize({ b: 2, a: 1 });
// -> {"a":1,"b":2}

const hash = crypto.createHash('sha256').update(canonical).digest('hex');

Common Use Cases

JWS / JWT Signing: Canonicalize payload before computing HMAC or RSA signature
Webhook Verification: Hash the canonical body to verify HMAC signatures from providers
Content Addressing: Compute stable content hashes for JSON documents in IPFS / CAS systems
Blockchain / Smart Contracts: Deterministic JSON encoding before on-chain storage or hashing
API Response Caching: Cache-key generation based on normalized request parameters
Data Deduplication: Identify duplicate JSON payloads with different key orderings

FAQ

Q: Does RFC 8785 affect array order?

A: No. Arrays preserve their original element order. Only object keys are sorted. Changing array order would produce a different hash.

Q: Is the SHA-256 hash computed in the browser?

A: Yes, this tool uses the browser's built-in Web Crypto API (crypto.subtle.digest). Your data never leaves your machine.

Q: How does this relate to JWK Thumbprint (RFC 7638)?

A: RFC 7638 uses a similar key-sorted, whitespace-free JSON approach to compute a stable identifier for JSON Web Keys. JCS (RFC 8785) generalises this to arbitrary JSON.

Where JSON canonicalization matters

Two JSON documents can hold the same data but differ in key order, spacing and number formatting. Canonicalization gives them one exact byte representation, which is required whenever you hash or sign JSON.

Tips and common pitfalls

Canonicalize on both sides: the signer and the verifier must apply the same RFC 8785 rules before hashing.
Numbers are written the way JavaScript prints them, so 1.0 becomes 1 and 1e2 becomes 100.
Keys are sorted by UTF-16 code units, which can differ from a simple alphabetical sort for non-ASCII keys.
Use it for content-addressed caching: a hash of canonical JSON gives the same cache key for equivalent requests.

JSON Canonicalizer