PKCE Code Verifier & Challenge Generator

🧰 Tools

🔐PKCE 📜SAML 🔗URL ⏰Time 🎫JWT 🚀REST 📝YAML 🔄XML 🔤B64 🔒ROT47 🏗️ForgeRock

📦 Step 1: Generate Code Verifier

Code Verifier (save this for token exchange!):

🔐 Step 2: Code Challenge Method

S256 (recommended - SHA256) plain (not recommended)

Code Challenge (for authorization request):

🌐 Step 3: Complete Authorization URL (optional)

Authorization Endpoint:

Client ID:

Redirect URI:

Scope:

Generated Authorization URL:

ℹ️ What is PKCE?

PKCE (Proof Key for Code Exchange, RFC 7636) adds security to the OAuth 2.0 Authorization Code Flow, especially for public clients like mobile apps and SPAs.

How it works:

Client generates random code_verifier (43-128 chars)
Client creates code_challenge = BASE64URL(SHA256(code_verifier))
Client sends code_challenge in authorization request
Authorization server stores the challenge
Client sends original code_verifier in token request
Server verifies: SHA256(code_verifier) == code_challenge

⚠️ Important: Save the code_verifier! You'll need it when exchanging the authorization code for tokens.

📖 Related Articles

🔒 Privacy Notice

All calculations are performed locally in your browser using the Web Crypto API. No data is sent to any server. Your code_verifier and code_challenge never leave your device.

Latest Articles