OAuth PKCE Generator
Generate RFC 7636 verifier, S256 challenge and authorization parameters
Optional: also build an authorization URL
Treat the verifier as a temporary credential: send only the challenge to authorization, then submit the original verifier to the token endpoint.
Generate to see the verifier, challenge, and optional authorization URL.
About this tool
OAuth PKCE Generator creates a cryptographically random RFC 7636 code_verifier with a configurable valid length, then derives either the recommended S256 code_challenge or the plain fallback. Optional authorization endpoint, client ID, redirect URI, scope, and state fields produce a ready-to-inspect authorization URL. Randomness and SHA-256 hashing use browser cryptography APIs. The verifier remains local and must be retained by the client until the authorization code is exchanged.
Scenario Recipes
Prepare a public-client authorization request
Goal: Generate a fresh verifier pair and inspect the complete authorization URL
- Keep S256 selected and generate a new verifier for this attempt.
- Fill the endpoint, client ID, redirect URI, scope, and a separate state value.
- Send the authorization URL while retaining the verifier for the token exchange.
Result: A standards-based PKCE authorization request and locally retained verifier.
Frequently Asked Questions
What verifier length should I use?
RFC 7636 permits 43 to 128 characters. A 64-character verifier is a practical secure default.
Should I choose S256 or plain?
Use S256 whenever the authorization server supports it. Plain exposes the verifier-equivalent value in the authorization request.
How is the S256 challenge calculated?
It is the Base64url encoding without padding of SHA-256 applied to the ASCII code_verifier.
Where should the verifier be sent?
Keep it in the client during authorization and send it only to the token endpoint when exchanging the authorization code.
Does PKCE replace the OAuth state parameter?
No. PKCE protects authorization-code interception, while state helps bind the response and mitigate request forgery.
Are generated PKCE values stored?
No. Values are generated locally and are cleared when the page state is reset or discarded.
Keep browsing