Canonicalize JSON (RFC 8785)
Produce the RFC 8785 canonical form of a JSON document — keys sorted by UTF-16 code unit, no insignificant whitespace, numbers in their shortest round-trip form — plus a hash of the result. Two documents that mean the same thing canonicalise to identical bytes, which is what makes signing and content addressing possible.
How to canonicalize JSON and hash it
- Paste your JSON document.
- The canonical form appears immediately — one line, keys sorted at every level.
- Pick a Hash algorithm. SHA-256 is the right default; SHA-1 is there only for legacy systems that still require it.
- The digest is computed with the Web Crypto API in your browser. Copy the canonical bytes, the hash, or both.
What canonicalisation guarantees
JSON has many byte representations of the same data: key order is not significant, whitespace is free,
and 1.0, 1 and 1e0 are the same number. That flexibility breaks
anything that compares bytes — signatures, content-addressed storage, cache keys, deduplication.
RFC 8785 fixes a single representation:
- Object keys sorted by UTF-16 code unit. Note that this puts
"10"before"9"— it is a string sort, not numeric. - No whitespace anywhere outside string values.
- Numbers serialised with the ECMAScript shortest round-trip algorithm, so
1.0becomes1. - Strings with minimal escaping — only what JSON requires.
- Array order preserved, because array order is significant.
Where this gets used
- Detached signatures. Signing raw JSON is unsafe — reformatting invalidates the signature. Sign the canonical form. This is the basis of JWS with unencoded payloads and of several verifiable-credential formats.
- Content addressing. The hash becomes a stable identifier for the document's meaning, not its formatting.
- Deduplication. Exactly what Dedupe array uses internally to compare records regardless of key order.
- Idempotency and cache keys. Two clients sending equivalent payloads produce one key.
Privacy
Nothing is uploaded. The conversion runs in this tab using your own browser's JavaScript engine — no server sees your data, and the page keeps working with the network disconnected.
FAQ
Why is the hash missing?
The Web Crypto API is only available in a secure context. On https:// or localhost it works; over plain http the browser withholds it and the canonical form is shown without a digest.
Can it canonicalize NaN or Infinity?
No, and neither can JSON — they are not valid JSON values. If your producer emits them, replace them with null or a string first.
Is this the same as JSON.stringify with sorted keys?
Almost, and the difference bites. JSON.stringify on an object with numeric-looking keys reorders them numerically ("9" before "10"), while RFC 8785 requires string order. This tool serialises manually to get that right.