Free online tools that run in your browser

PKCE Code Verifier and Code Challenge Generator

Generate a code_verifier or paste your own, and get the S256 code_challenge for OAuth 2.0 PKCE (RFC 7636).

code_challenge (S256)

Runs entirely in your browser. Nothing you enter is sent or stored.

How to use

  1. Press Generate for a new random code_verifier, or paste one.
  2. The code_challenge is computed as BASE64URL(SHA-256(code_verifier)).
  3. Send code_challenge with code_challenge_method=S256 in the authorization request.
  4. Send the code_verifier in the token request.

Frequently asked questions

What is PKCE?

Proof Key for Code Exchange (RFC 7636). The client sends a hashed code_challenge with the authorization request and the original code_verifier with the token request, so a stolen authorization code cannot be redeemed alone.

How is the code_challenge calculated?

With method S256: SHA-256 of the ASCII code_verifier, then base64url-encoded without padding. For the RFC 7636 example verifier dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk the result is E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM.

Why is the generated verifier 43 characters?

32 random bytes encoded as base64url without padding are 43 characters, the minimum length RFC 7636 allows (43 to 128 characters of A-Z, a-z, 0-9, -, ., _, ~).

Related tools

Password GeneratorRandom passwords and strings