PKCE Generator — OAuth Code Verifier & Challenge

Verifier Length

Method

S256

Code Verifier

Code Challenge (S256)

SHA-256 → Base64url

What is PKCE?

Proof Key for Code Exchange (RFC 7636) protects OAuth 2.0 public clients from authorization code interception attacks. The client creates a random code_verifier, derives a code_challenge using SHA-256, and sends the challenge with the authorization request. The verifier is sent later during token exchange to prove ownership.