x5t#S256 — X.509 Certificate SHA-256 Thumbprint

Location: header · Format: string

A base64url-encoded SHA-256 digest of the DER-encoded signing certificate — the modern, recommended replacement for the SHA-1-based x5t.

Defined in RFC 7515 §4.1.8.

Decode a JWT and inspect its x5t#S256 claim in the TokenPrism debugger — free, entirely in your browser.