PKCE Code Challenge Generator
Generate a PKCE code_verifier and its S256 code_challenge for OAuth 2.0, plus a state and nonce, or compute the challenge for a verifier you already have.
Free · No sign-up · Your inputs stay in your browser
Input
Generate a PKCE code verifier and challenge
Output
No verifier yet
PKCE (RFC 7636) binds the authorization code to the client that asked for it: the app sends the SHA-256 of a random verifier with the authorize request and the verifier itself with the token request, so an intercepted code is useless. OAuth 2.1 requires it for every client, public or not. The verifier is 43 to 128 characters of A-Z, a-z, 0-9 and - . _ ~.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
What PKCE prevents
An authorization code travels through the browser's redirect, where another app on the device or a leaky log could intercept it. With PKCE, the client sends the challenge with the authorize request and the verifier with the token request, and the server only issues tokens if they match, so a stolen code is useless. RFC 7636 defines it, and OAuth 2.1 makes it mandatory for all clients.
Plain is not an option
The plain method sends the verifier itself as the challenge and only exists for clients that cannot compute SHA-256. Every current platform can, so use S256.