Cryptography

PKCE Generator & Verifier

Generate and verify OAuth PKCE S256 verifier and challenge pairs.

How the PKCE S256 pair is created

A PKCE client creates a high-entropy code verifier, hashes its exact ASCII value with SHA-256, and sends the unpadded Base64url result as the code challenge. The authorization request includes code_challenge and code_challenge_method=S256. The later token request sends the original code_verifier so the authorization server can derive and compare the same challenge.

Loading tool...

Verifier rules and verification

  • Generate creates 43 to 128 characters from the RFC 7636 unreserved character set using rejection-sampled secure random bytes.
  • Derive accepts an existing verifier only when its full value satisfies the length and character rules.
  • Verify derives S256 again and compares it with an exact 43-character Base64url challenge.
  • Whitespace is significant. Copy the verifier exactly and retain it only for the matching authorization flow.

Security boundary

PKCE protects an authorization code from being redeemed without the matching verifier; it does not replace redirect URI validation, OAuth state or OIDC nonce checks, TLS, secure token storage, or authorization-server validation. Generation and hashing happen locally in this browser, but clipboard history, extensions, logs, or a shared device can still expose copied values.

Related developer tools

Continue with SHA256 Hash, HMAC Generator & Verifier, UUID v4 & v7 Generator.

SHA256 Hash

Generate SHA256 hashes

HMAC Generator & Verifier

Generate and verify keyed SHA message authentication codes

UUID v4 & v7 Generator

Generate random v4 or timestamp-based v7 UUIDs

How to Use PKCE Generator & Verifier

  1. Choose a verifier length from 43 to 128 characters and generate a secure pair.
  2. Send the challenge with code_challenge_method=S256 in the authorization request.
  3. Keep the verifier in the OAuth client and send it only during the matching token exchange.
  4. To debug an existing pair, paste the verifier and expected challenge, then verify them.

Frequently Asked Questions

What is PKCE?

PKCE is an OAuth extension that binds an authorization request to a secret code verifier held by the client, reducing authorization-code interception risk.

Which challenge method does this tool use?

It uses S256: SHA-256 of the code verifier encoded as unpadded Base64url. The plain method is intentionally not generated.

Can I use the generated value in production?

The values use secure browser randomness and valid PKCE characters, but you should generate and retain production verifiers inside the OAuth client that will complete the token exchange.

Sources & references

Primary references: RFC 7636: Proof Key for Code Exchange by OAuth Public Clients.

Last reviewed: