How to use the PKCE Generator
- A code verifier and its S256 challenge are generated right away; click Generate new for another pair, or paste your own verifier to see its challenge.
- Fill in your provider’s authorization and token endpoints,
client_id,redirect_uriandscope. - Open the authorization URL, sign in, and copy the
codefrom the redirect. - Run the token request (curl) with that code — the verifier proves you started the login.
How PKCE protects the login
PKCE (Proof Key for Code Exchange, RFC 7636) stops a stolen authorization code from being used by anyone else. The app creates a random secret — the code verifier — and sends only its hash, the code challenge, with the login request. When it exchanges the returned code for tokens, it sends the verifier itself; the server hashes it and checks that it matches. An attacker who intercepts the code doesn’t have the verifier.
- The verifier is 43–128 characters from
A–Z a–z 0–9 - . _ ~. - S256:
code_challenge = BASE64URL(SHA256(code_verifier)), without padding. - OAuth 2.1 requires PKCE for every client, including server-side apps — not just mobile and single-page apps.
stateprotects against CSRF;nonceties an OpenID Connect ID token to this login.
Decode the tokens you get back with the JWT Decoder, or try the token call in the API Tester.
Also searched as: code verifier generator, code challenge generator, pkce code challenge, oauth pkce, oauth2 pkce example, s256 code challenge, pkce online.
Tools that pair well with the PKCE Generator
- JWT Encoder — Build a JWT for testing APIs: edit the payload, add standard claims with one click and sign it with an HMAC secret or an RSA / EC private key.
- Base64 Encode / Decode — Convert text to Base64 and back with full UTF-8 support (accents, emoji), switch to URL-safe Base64, or drop a file to get its Base64 string or data URI.
- Password Generator — Create strong, truly random passwords or easy-to-type passphrases — with advanced rules: include or exclude words, require characters, choose allowed symbols, avoid repeats and sequences.
- IBAN Validator — Check whether an IBAN is valid before you send money or save it: the country, the length for that country, the account format and the mod-97 checksum.
Frequently asked questions
How is the PKCE code challenge calculated?
Take the SHA-256 hash of the code verifier (as ASCII bytes) and encode it with base64url without = padding. That is the S256 method this tool uses.
How long should the code verifier be?
Between 43 and 128 characters. 43 characters of random base64url text carry 256 bits of randomness, which is plenty; longer is fine too.
Should I use S256 or plain?
Always S256. plain sends the verifier itself as the challenge, which protects nothing if the request is seen; it exists only for clients that can’t compute SHA-256.
Are the values sent anywhere?
No. They are generated with the browser’s crypto API and only leave the page if you copy them or open the authorization URL.
Can I install PKCE Generator as a web app and use it offline?
Yes. PKCE Generator is an installable web app (PWA) — installed from your browser, not downloaded from an app store. Click Install app at the top of this page in Chrome or Edge (Windows, macOS, Linux, ChromeOS) or on Android, use Share → Add to Home Screen on iPhone and iPad, or File → Add to Dock in Safari 17+ on a Mac. It then opens in its own window with its own icon, and because it runs entirely in your browser it keeps working offline. Firefox on desktop can’t install web apps. How installing works.