ronutz
← Tools

OAuth PKCE Verifier & Challenge

Generate an OAuth 2.0 code_verifier and derive its S256 code_challenge, or paste your own and check it against RFC 7636's length and charset rules. The same SHA-256 base64url derivation your authorization server expects. Runs entirely in your browser.

Generation and derivation run locally. Your verifier never leaves your browser.

How PKCE works

App / ClientAuthorization server
1Generate a random code_verifiercode_verifier2Derive the code_challengecode_challenge3Authorization request carries the challenge/authorize4Server stores the challenge5Authorization code returnedauthorization_code6Token request carries the verifier/token7Server re-derives and comparesS256(verifier) == challenge8Access and refresh tokens issuedaccess + refresh

References