x5t — X.509 Certificate SHA-1 Thumbprint

Location: header · Format: string

A base64url-encoded SHA-1 digest of the DER-encoded signing certificate, used as a lookup hint similar to kid. SHA-1 is deprecated for security purposes, so prefer x5t#S256 where available.

Defined in RFC 7515 §4.1.7.

Decode a JWT and inspect its x5t claim in the TokenPrism debugger — free, entirely in your browser.