How to compute a JWK thumbprint (RFC 7638) in WebCrypto

1// RFC 7638: the required members only, in lexicographic order, no whitespace
2const REQUIRED = { EC: ["crv", "kty", "x", "y"], RSA: ["e", "kty", "n"], OKP: ["crv", "kty", "x"], oct: ["k", "kty"] };
3 
4async function jwkThumbprint(jwk) {
5  const members = REQUIRED[jwk.kty];
6  if (!members) throw new Error(`unsupported kty ${jwk.kty}`);
7  // JSON.stringify keeps insertion order, so building the object in sorted order is enough
8  const canonical = JSON.stringify(Object.fromEntries(members.map((name) => [name, jwk[name]])));
9  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonical)));
10  return btoa(String.fromCharCode(...digest)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
11}

1// A CryptoKey (generated, or imported from SPKI) exports its public JWK when extractable
2async function cryptoKeyThumbprint(publicKey) {
3  return jwkThumbprint(await crypto.subtle.exportKey("jwk", publicKey));
4}
5 
6const spki = Uint8Array.from(atob(ecPublicKeyPem.replace(/-----[^-]+-----|\s+/g, "")), (c) => c.charCodeAt(0));
7const key = await crypto.subtle.importKey("spki", spki, { name: "ECDSA", namedCurve: "P-256" }, true, ["verify"]);
8console.log(`ec.pub.pem: ${await cryptoKeyThumbprint(key)}`);