diff --git a/jose.cabal b/jose.cabal
--- a/jose.cabal
+++ b/jose.cabal
@@ -1,5 +1,5 @@
 name:                jose
-version:             0.1.26.0
+version:             0.1.27.0
 synopsis:            Javascript Object Signing and Encryption
 description:
   .
@@ -21,7 +21,7 @@
   README.md
 author:              Fraser Tweedale
 maintainer:          frase@frase.id.au
-copyright:           Copyright (C) 2013  Fraser Tweedale
+copyright:           Copyright (C) 2013, 2014  Fraser Tweedale
 category:            Cryptography
 build-type:          Simple
 cabal-version:       >= 1.8
@@ -45,21 +45,21 @@
     Crypto.JOSE.Types.Internal
 
   build-depends:
-    base == 4.*,
-    attoparsec,
-    base64-bytestring == 1.0.*,
-    byteable == 0.1.*,
-    crypto-pubkey == 0.2.*,
-    crypto-random == 0.0.7.*,
-    cryptohash == 0.11.*,
-    template-haskell >= 2.4,
-    aeson == 0.7.*,
-    unordered-containers == 0.2.*,
-    bytestring == 0.10.*,
-    text == 1.1.*,
-    network >= 2.4,
-    certificate == 1.3.*,
-    vector
+    base == 4.*
+    , attoparsec
+    , base64-bytestring == 1.0.*
+    , byteable == 0.1.*
+    , crypto-pubkey == 0.2.*
+    , crypto-random == 0.0.7.*
+    , cryptohash == 0.11.*
+    , template-haskell >= 2.4
+    , aeson == 0.7.*
+    , unordered-containers == 0.2.*
+    , bytestring == 0.10.*
+    , text == 1.1.*
+    , network >= 2.4
+    , certificate == 1.3.*
+    , vector
 
   ghc-options:    -Wall
   hs-source-dirs: src
@@ -70,16 +70,23 @@
 
 test-suite tests
   type:           exitcode-stdio-1.0
-  hs-source-dirs: test
+  hs-source-dirs: src, test
   main-is:        Test.hs
 
   build-depends:
-    base,
-    base64-bytestring,
-    bytestring,
-    network,
-    unordered-containers,
-    attoparsec,
-    hspec,
-    aeson,
-    jose
+    base
+    , attoparsec
+    , base64-bytestring
+    , byteable
+    , crypto-pubkey
+    , crypto-random
+    , cryptohash
+    , template-haskell
+    , aeson
+    , unordered-containers
+    , bytestring
+    , text
+    , network
+    , certificate
+    , vector
+    , hspec
diff --git a/src/Crypto/JOSE/JWK.hs b/src/Crypto/JOSE/JWK.hs
--- a/src/Crypto/JOSE/JWK.hs
+++ b/src/Crypto/JOSE/JWK.hs
@@ -1,4 +1,4 @@
--- Copyright (C) 2013  Fraser Tweedale
+-- Copyright (C) 2013, 2014  Fraser Tweedale
 --
 -- Licensed under the Apache License, Version 2.0 (the "License");
 -- you may not use this file except in compliance with the License.
@@ -76,29 +76,31 @@
 
 -- | JWK §3.  JSON Web Key (JWK) Format
 --
-data JWK =
-  JWK {
-    jwkMaterial :: JWA.JWK.KeyMaterial,
-    jwkUse :: Maybe KeyUse,
-    jwkKeyOps :: Maybe [KeyOp],
-    jwkAlg :: Maybe Alg,
-    jwkKid :: Maybe String,
-    jwkX5u :: Maybe Types.URI,
-    jwkX5t :: Maybe Types.Base64SHA1,
-    jwkX5c :: Maybe [Types.Base64X509]
-    }
+data JWK = JWK
+  {
+    jwkMaterial :: JWA.JWK.KeyMaterial
+  , jwkUse :: Maybe KeyUse
+  , jwkKeyOps :: Maybe [KeyOp]
+  , jwkAlg :: Maybe Alg
+  , jwkKid :: Maybe String
+  , jwkX5u :: Maybe Types.URI
+  , jwkX5c :: Maybe [Types.Base64X509]
+  , jwkX5t :: Maybe Types.Base64SHA1
+  , jwkX5tS256 :: Maybe Types.Base64SHA256
+  }
   deriving (Eq, Show)
 
 instance FromJSON JWK where
-  parseJSON = withObject "JWK" (\o -> JWK <$>
-    parseJSON (Object o) <*>
-    o .:? "use" <*>
-    o .:? "key_ops" <*>
-    o .:? "alg" <*>
-    o .:? "kid" <*>
-    o .:? "x5u" <*>
-    o .:? "x5t" <*>
-    o .:? "x5c")
+  parseJSON = withObject "JWK" $ \o -> JWK
+    <$> parseJSON (Object o)
+    <*> o .:? "use"
+    <*> o .:? "key_ops"
+    <*> o .:? "alg"
+    <*> o .:? "kid"
+    <*> o .:? "x5u"
+    <*> o .:? "x5c"
+    <*> o .:? "x5t"
+    <*> o .:? "x5t#S256"
 
 instance ToJSON JWK where
   toJSON (JWK {..}) = object $ catMaybes
@@ -107,8 +109,9 @@
     , fmap ("key_ops" .=) jwkKeyOps
     , fmap ("kid" .=) jwkKid
     , fmap ("x5u" .=) jwkX5u
-    , fmap ("x5t" .=) jwkX5t
     , fmap ("x5c" .=) jwkX5c
+    , fmap ("x5t" .=) jwkX5t
+    , fmap ("x5t#S256" .=) jwkX5tS256
     ]
     ++ Types.objectPairs (toJSON jwkMaterial)
 
@@ -119,7 +122,7 @@
 -- | Construct a minimal JWK from key material.
 --
 materialJWK :: JWA.JWK.KeyMaterial -> JWK
-materialJWK m = JWK m n n n n n n n where n = Nothing
+materialJWK m = JWK m n n n n n n n n where n = Nothing
 
 -- | Generate a /(public, private)/ RSA keypair.
 --
diff --git a/src/Crypto/JOSE/JWS/Internal.hs b/src/Crypto/JOSE/JWS/Internal.hs
--- a/src/Crypto/JOSE/JWS/Internal.hs
+++ b/src/Crypto/JOSE/JWS/Internal.hs
@@ -1,4 +1,4 @@
--- Copyright (C) 2013  Fraser Tweedale
+-- Copyright (C) 2013, 2014  Fraser Tweedale
 --
 -- Licensed under the Apache License, Version 2.0 (the "License");
 -- you may not use this file except in compliance with the License.
@@ -50,6 +50,7 @@
   , "jwk"
   , "x5u"
   , "x5t"
+  , "x5t#S256"
   , "x5c"
   , "kid"
   , "typ"
@@ -89,8 +90,9 @@
   , headerJwk :: Maybe JWK
   , headerKid :: Maybe String  -- ^ interpretation unspecified
   , headerX5u :: Maybe Types.URI
-  , headerX5t :: Maybe Types.Base64SHA1
   , headerX5c :: Maybe [Types.Base64X509] -- ^ TODO implement min len of 1
+  , headerX5t :: Maybe Types.Base64SHA1
+  , headerX5tS256 :: Maybe Types.Base64SHA256
   , headerTyp :: Maybe String  -- ^ Content Type (of object)
   , headerCty :: Maybe String  -- ^ Content Type (of payload)
   , headerCrit :: Maybe CritParameters
@@ -101,8 +103,8 @@
 instance Eq Header where
   a == b =
     let
-      ignoreRaw (Header alg jku jwk kid x5u x5t x5c typ cty crit _)
-        = (alg, jku, jwk, kid, x5u, x5t, x5c, typ, cty, crit)
+      ignoreRaw (Header alg jku jwk kid x5u x5c x5t x5tS256 typ cty crit _)
+        = (alg, jku, jwk, kid, x5u, x5c, x5t, x5tS256, typ, cty, crit)
     in
       ignoreRaw a == ignoreRaw b
 
@@ -118,6 +120,7 @@
     <*> opt "kid"
     <*> opt "x5u"
     <*> opt "x5t"
+    <*> opt "x5t#S256"
     <*> opt "x5c"
     <*> opt "typ"
     <*> opt "cty"
@@ -134,14 +137,15 @@
     parseHeaderWith (o .:) (o .:?) (parseCrit o))
 
 instance ToJSON Header where
-  toJSON (Header alg jku jwk kid x5u x5t x5c typ cty crit _) = object $ catMaybes [
+  toJSON (Header alg jku jwk kid x5u x5c x5t x5tS256 typ cty crit _) = object $ catMaybes [
     Just ("alg" .= alg)
     , fmap ("jku" .=) jku
     , fmap ("jwk" .=) jwk
     , fmap ("kid" .=) kid
     , fmap ("x5u" .=) x5u
-    , fmap ("x5t" .=) x5t
     , fmap ("x5c" .=) x5c
+    , fmap ("x5t" .=) x5t
+    , fmap ("x5t#S256" .=) x5tS256
     , fmap ("typ" .=) typ
     , fmap ("cty" .=) cty
     ]
@@ -150,7 +154,7 @@
 
 -- construct a minimal header with the given alg
 algHeader :: JWA.JWS.Alg -> Header
-algHeader alg = Header alg n n n n n n n n n n where n = Nothing
+algHeader alg = Header alg n n n n n n n n n n n where n = Nothing
 
 
 (.::) :: (FromJSON a) => Object -> Object -> T.Text -> Parser a
diff --git a/src/Crypto/JOSE/Types.hs b/src/Crypto/JOSE/Types.hs
--- a/src/Crypto/JOSE/Types.hs
+++ b/src/Crypto/JOSE/Types.hs
@@ -1,4 +1,4 @@
--- Copyright (C) 2013  Fraser Tweedale
+-- Copyright (C) 2013, 2014  Fraser Tweedale
 --
 -- Licensed under the Apache License, Version 2.0 (the "License");
 -- you may not use this file except in compliance with the License.
@@ -99,6 +99,22 @@
 
 instance ToJSON Base64SHA1 where
   toJSON (Base64SHA1 bytes) = encodeB64Url bytes
+
+
+-- | A base64url encoded SHA-256 digest.  Used for X.509 certificate
+-- thumbprints.
+--
+newtype Base64SHA256 = Base64SHA256 BS.ByteString
+  deriving (Eq, Show)
+
+instance FromJSON Base64SHA256 where
+  parseJSON = withText "base64url SHA-256" $ parseB64Url (\bytes ->
+    case BS.length bytes of
+      32 -> pure $ Base64SHA256 bytes
+      _  -> fail "incorrect number of bytes")
+
+instance ToJSON Base64SHA256 where
+  toJSON (Base64SHA256 bytes) = encodeB64Url bytes
 
 
 -- | A base64 encoded X.509 certificate.