PKCE Code Generator
Generate PKCE code verifier and code challenge for OAuth 2.0 (S256 / SHA-256). Everything happens in your browser — nothing is sent anywhere.
How to use: send
code_challenge in the authorization request (with code_challenge_method=S256), and code_verifier in the token request. Both are created in your browser — nothing went to a server.
How to use
- Choose the challenge method (S256 recommended) and the verifier length.
- Press "Generate New Pair".
- Save the verifier in your app, and send the challenge in the authorization URL.
Frequently Asked Questions (FAQ)
What does the PKCE Code Generator do?
It generates a PKCE code verifier and the matching code challenge pair for OAuth 2.0 flows.
Which challenge method should I choose?
S256 is recommended. It hashes the verifier with SHA-256, which is the secure standard for OAuth 2.0.
How do I use the pair in my OAuth flow?
Choose the verifier length, press Generate New Pair, save the verifier in your app, and send the challenge in the authorization URL.
Is my code verifier sent anywhere?
No. Everything happens in your browser and nothing is sent anywhere, so your verifier stays private.