Como usar: PKCE Generator
- A code verifier and its S256 challenge are generated right away; click Generate new for another pair, or paste your own verifier to see its challenge.
- Fill in your provider’s authorization and token endpoints,
client_id,redirect_uriandscope. - Open the authorization URL, sign in, and copy the
codefrom the redirect. - Run the token request (curl) with that code — the verifier proves you started the login.
How PKCE protects the login
PKCE (Proof Key for Code Exchange, RFC 7636) stops a stolen authorization code from being used by anyone else. The app creates a random secret — the code verifier — and sends only its hash, the code challenge, with the login request. When it exchanges the returned code for tokens, it sends the verifier itself; the server hashes it and checks that it matches. An attacker who intercepts the code doesn’t have the verifier.
- The verifier is 43–128 characters from
A–Z a–z 0–9 - . _ ~. - S256:
code_challenge = BASE64URL(SHA256(code_verifier)), without padding. - OAuth 2.1 requires PKCE for every client, including server-side apps — not just mobile and single-page apps.
stateprotects against CSRF;nonceties an OpenID Connect ID token to this login.
Decode the tokens you get back with the JWT Decoder, or try the token call in the API Tester.
Também pesquisado como: code verifier generator, code challenge generator, pkce code challenge, oauth pkce, oauth2 pkce example, s256 code challenge, pkce online.
Ferramentas que combinam com: PKCE Generator
- JWT Encoder — Build a JWT for testing APIs: edit the payload, add standard claims with one click and sign it with an HMAC secret or an RSA / EC private key.
- Hash Generator — Compute MD5 and SHA hashes of any text or file instantly, create HMAC signatures, and paste an expected checksum to verify a download.
- Codificação/Decodificação Base64 — Converte texto para Base64 e vice-versa, com suporte total a UTF-8 (acentos, emojis); alterna para Base64 seguro para URLs; ou arrasta um arquivo para obter sua string Base64 ou URI de dados.
- Gerador de senhas — Crie senhas fortes e verdadeiramente aleatórias ou frases-senha fáceis de digitar — com regras avançadas: inclua ou exclua palavras, exija determinados caracteres, escolha os símbolos permitidos, evite repetições e sequências.
Perguntas frequentes
How is the PKCE code challenge calculated?
Take the SHA-256 hash of the code verifier (as ASCII bytes) and encode it with base64url without = padding. That is the S256 method this tool uses.
How long should the code verifier be?
Between 43 and 128 characters. 43 characters of random base64url text carry 256 bits of randomness, which is plenty; longer is fine too.
Should I use S256 or plain?
Always S256. plain sends the verifier itself as the challenge, which protects nothing if the request is seen; it exists only for clients that can’t compute SHA-256.
Are the values sent anywhere?
No. They are generated with the browser’s crypto API and only leave the page if you copy them or open the authorization URL.
Posso instalar o PKCE Generator como um aplicativo da web e usá-lo offline?
Sim. O PKCE Generator é um aplicativo da web instalável (PWA) — instalado a partir do seu navegador, não baixado de uma loja de aplicativos. Clique em “Instalar aplicativo” na parte superior desta página no Chrome ou no Edge (Windows, macOS, Linux, ChromeOS) ou, no Android, use “Compartilhar” → “Adicionar à tela inicial” no iPhone e no iPad, ou “Arquivo” → “Adicionar ao Dock” no Safari 17+ em um Mac. Em seguida, ela se abre em uma janela própria com seu próprio ícone e, como é executada inteiramente no seu navegador, continua funcionando offline. O Firefox no desktop não permite a instalação de aplicativos da web. Como funciona a instalação.