OAuth 2.0 PKCE Generator & Validator

PKCE (Proof Key for Code Exchange) protects OAuth 2.0 authorization code flows from interception attacks — and is now mandatory for SPAs and mobile apps. Generate cryptographically secure code_verifier / code_challenge pairs, or validate an existing pair, entirely in your browser.

Privacy, Security & Web APIs 100% Air-Gapped Cryptographic material never leaves your browser.

Verifier length 64

code_verifier (keep secret)

code_challenge (send to /authorize)

code_challenge_method

S256

RFC 7636 Rules

Verifier length: 43–128 characters
Charset: [A-Z] [a-z] [0-9] - . _ ~
S256: BASE64URL(SHA256(verifier))
plain: challenge = verifier

Why PKCE?

Without PKCE, an attacker who intercepts the authorization code can exchange it for an access token. PKCE binds the token exchange to the original client by requiring the code_verifier, which only the legitimate client knows.

S256 vs plain

Always use S256. The plain method offers no protection if the challenge is intercepted, since the challenge equals the verifier. It's included here only for debugging legacy systems.

Introduction

OAuth 2.1 makes PKCE mandatory for all clients — not just public ones. Whether you're building a React SPA, a mobile app, or debugging an existing integration, you need a way to generate and verify PKCE pairs without shipping the verifier to a third-party tool. This tool does it all locally.

How It Works

The code_verifier is generated using crypto.getRandomValues() from the RFC 7636 unreserved character set.
For S256, the verifier is hashed with crypto.subtle.digest('SHA-256') and Base64URL-encoded to produce the code_challenge.
For plain, the challenge equals the verifier.
The validator recomputes the challenge from a given verifier and compares it to the provided challenge.

Privacy

This tool makes zero network requests. The code_verifier is cryptographically sensitive material — it must be kept secret until the token exchange step. Generating it locally ensures it is never exposed to a third party.

Limitations

This tool generates and validates PKCE pairs only; it does not perform the actual OAuth token exchange.
The plain method is included for legacy debugging but should never be used in production.

FAQ

What length should the code_verifier be?

RFC 7636 allows 43–128 characters. A length of 64+ provides strong entropy. This tool defaults to 64.

Is it safe to generate a verifier here?

Yes. Generation uses the browser's cryptographically secure random number generator, and nothing is transmitted. The verifier exists only in your browser's memory.

Why is my pair showing a mismatch?

Ensure you've selected the correct method (S256 vs plain) and that there are no extra whitespace characters in the verifier or challenge.

Related Tools

Version and changelog

Version: 1.0.0
Last updated: August 13, 2026
Changelog: Initial production release.