What is PKCE Generator
The PKCE Generator creates Proof Key for Code Exchange (PKCE) challenge-response pairs used to secure OAuth 2.0 authorization code flows. PKCE (pronounced "pixy") prevents authorization code interception attacks by requiring the client to prove it initiated the authorization request. The generator produces two values: a high-entropy code verifier (a random 43-128 character string) and its corresponding code challenge (the verifier hashed with SHA-256 and Base64Url-encoded).
The code verifier is sent with the token exchange request, while the code challenge is sent with the initial authorization request. The server verifies that the hash of the submitted verifier matches the stored challenge, confirming that the same client that started the flow is completing it. PKCE is now required by OAuth 2.1 for all public clients (SPAs, mobile apps, CLI tools) and recommended even for confidential clients.
How to Use PKCE Generator
- Click Generate to create a fresh code verifier and code challenge pair. A new random verifier is generated each time using cryptographic randomness.
- Copy the code verifier — this is the secret value you send with your token exchange request (
code_verifier parameter). Store it temporarily in memory or session storage during the OAuth flow. - Copy the code challenge — this is the value you send with your authorization request (
code_challenge parameter). It is safe to include in URLs and browser redirects. - Select the challenge method —
S256 (SHA-256 hash) is the required method for OAuth 2.1. plain is supported but should only be used when the client cannot perform SHA-256.
Why Use PKCE Generator
When implementing OAuth 2.0 login flows in SPAs, mobile apps, or CLI tools, PKCE is now a mandatory security requirement. Without PKCE, an attacker who intercepts the authorization code (by registering a custom URI scheme or exploiting a redirect vulnerability) can exchange it for tokens. PKCE prevents this by ensuring only the client that initiated the request can complete it.
Developers use this generator during OAuth integration testing — generating known verifier/challenge pairs to verify their server correctly validates PKCE. It is also useful for understanding PKCE mechanics — seeing the actual values makes the protocol concrete, whereas reading the RFC abstractly can be confusing. Security auditors use it to verify that PKCE is correctly implemented in existing applications.
Privacy & Security
This tool runs entirely in your browser — no data ever leaves your device. There is no server round-trip, no upload, no logging, and no account required. Your input is processed locally using client-side JavaScript and is never stored, transmitted, or accessible to anyone else. When you close the tab, everything disappears.
Frequently Asked Questions
What is the difference between S256 and plain?
S256 hashes the code verifier with SHA-256 before sending it as the code challenge. This means the authorization server never sees the raw verifier during the authorization step — only during token exchange. Plain sends the verifier itself as the challenge, which is less secure because the verifier is exposed in the authorization URL. OAuth 2.1 requires S256 for all new implementations.
How long should the code verifier be?
The RFC 7636 specification requires the verifier to be 43-128 characters from the unreserved character set ([A-Z] / [a-z] / [0-9] / "-" / "." / "_" / "~"). Longer is better — the generator produces 128-character verifiers by default, which provides 1024 bits of entropy. This is far more than necessary (76 bits is the minimum recommended), but extra entropy is free and costs nothing in practice.
Do I need PKCE for server-side web apps?
Traditionally, PKCE was only required for public clients (SPAs, mobile apps). However, OAuth 2.1 recommends PKCE for all clients, including confidential server-side apps. The reason: even with a client secret, authorization code interception is possible in certain network configurations. PKCE adds minimal implementation overhead and significantly improves security, so the trend is toward universal PKCE adoption.