PKCE Generator
OAuth PKCE code_verifier and S256 code_challenge, with state and nonce.
About this tool
Press New verifier to create a random code_verifier (43–128 characters) and its SHA-256 code_challenge, along with random state and nonce values. Fill in your authorization endpoint, client ID, redirect URI and scope to get an example authorize URL and token request body. Paste any verifier to check the challenge your code computes.
How PKCE protects the OAuth flow
In the authorization-code flow, an app sends the user to the identity provider and gets a short-lived code back on the redirect, which it exchanges for tokens. Public clients such as mobile apps and single-page apps can't keep a client secret, so a stolen code could be redeemed by an attacker. PKCE (RFC 7636) closes that gap. The app creates a random code_verifier, sends only its hash, the code_challenge = BASE64URL(SHA-256(verifier)), with the authorize request, and later proves it started the flow by sending the verifier with the token request. Only the app that knows the verifier can finish the exchange. The tool uses the RFC's unreserved characters and the S256 method. Its output reproduces the RFC 7636 test vector (dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk gives E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM). OAuth 2.1 and current best practice require PKCE for every client. Honest limits: in production, generate verifiers in your app at runtime and keep them in memory or session storage. This page is for learning, testing and debugging. The JWT decoder, the random string generator and the URL encoder are related.
Frequently asked questions
What is a PKCE code verifier?
A random 43–128 character string the app keeps secret and sends only at the token exchange.
How is the code challenge calculated?
BASE64URL(SHA-256(code_verifier)) without padding, sent with code_challenge_method=S256.
Is PKCE required?
OAuth 2.1 and current security best practice require it for all clients, including confidential ones.
Is anything uploaded?
No. Everything runs in your browser and nothing is stored or sent.