{
  "title": "PKCE challenge generator",
  "human_url": "https://happytails.ai/en/developer-tools/pkce-challenge-generator/",
  "agent_url": "https://happytails.ai/agents/en/developer-tools/pkce-challenge-generator/",
  "language": "en",
  "markdown_url": "https://happytails.ai/en/developer-tools/pkce-challenge-generator.md",
  "content": "PKCE challenge generator\nCreate an OAuth PKCE code verifier and its S256 code challenge in your browser. Paste your own verifier to check a challenge, or leave the box empty to generate a new random pair.\nHow can we improve this tool?\nReport a problem or share an idea.\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\nHow to use PKCE challenge generator\nPaste an existing code verifier, or leave the box empty to generate one.\nChoose S256 as the challenge method unless your server only supports plain.\nSet the length for a generated verifier, from 43 to 128 characters.\nRun the tool, copy the challenge into the authorization request and keep the verifier for the token request.\nUseful next steps\nJWT decoder\nHMAC generator\nPassword generator\nHow the challenge is made\nThe tool follows RFC 7636 (OAuth 2.0 PKCE, September 2015). The code challenge for S256 is the Base64url encoding, without padding, of the SHA-256 hash of the ASCII verifier. The result for the verifier in RFC 7636 appendix B matches the published value E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM.\nGenerated verifiers\nA blank input creates a verifier from the browser cryptographic random number generator, using only the 66 unreserved characters allowed by RFC 7636 and rejection sampling so every character is equally likely.\nLimits\nVerifiers must be 43 to 128 characters of letters, digits, hyphen, period, underscore or tilde. The plain method is shown with a warning because it gives no protection if the challenge is intercepted.",
  "content_format": "text/plain",
  "visibility": "public",
  "links": [
    {
      "name": "JWT decoder",
      "url": "https://happytails.ai/en/developer-tools/jwt-decoder/"
    },
    {
      "name": "HMAC generator",
      "url": "https://happytails.ai/en/developer-tools/hmac-generator/"
    },
    {
      "name": "Password generator",
      "url": "https://happytails.ai/en/privacy-tools/password-generator/"
    }
  ],
  "tool": {
    "id": "pkce-challenge-generator",
    "category": "developer-tools",
    "built": true,
    "requirements": "Input is one verifier of 43 to 128 characters, or empty to generate one. Hashing and generation run locally in your browser with Web Crypto; nothing is uploaded. Download the JSON report with the verifier, challenge and request parameters.",
    "implementation": {
      "fields": [
        {
          "key": "method",
          "label": "Challenge method",
          "value": "S256",
          "type": "select",
          "values": [
            "S256",
            "plain"
          ]
        },
        {
          "key": "length",
          "label": "Generated verifier length",
          "value": "64",
          "type": "number",
          "min": 43,
          "max": 128,
          "step": 1
        }
      ],
      "registrationFamily": "crypto-formats-reference",
      "inputMaxLength": 128,
      "inputErrorCode": "CRYPTO_FORMATS_REFERENCE_TOO_LONG",
      "note": "Runs in your browser. Paste a 43 to 128 character verifier or leave the box empty to generate one with the browser random number generator.",
      "experience": {
        "automatic": false,
        "single": true,
        "inputMaxLength": 128,
        "inputMode": "text",
        "label": "Code verifier (optional)",
        "placeholder": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk",
        "help": "Leave empty to generate a new verifier, or paste one of 43 to 128 characters. Up to 128 characters. Review the settings before running.",
        "action": null
      },
      "mode": "explicit",
      "interactive": false
    },
    "execution": "Browser interface",
    "api": null,
    "browser_agent": {
      "supported": true,
      "name": "run_current_tool",
      "discovery": "WebMCP on the human page in a supporting browser",
      "verification": "See audit/API-AUDIT.md; availability is not verification"
    }
  },
  "markdown": "# PKCE challenge generator\n\n- Human page: https://happytails.ai/en/developer-tools/pkce-challenge-generator/\n- Markdown: https://happytails.ai/en/developer-tools/pkce-challenge-generator.md\n- Structured JSON: https://happytails.ai/agents/en/developer-tools/pkce-challenge-generator/index.json\n- Visibility: public\n\n## Tool capabilities\n\n| Property | Value |\n| --- | --- |\n| Tool ID | `pkce-challenge-generator` |\n| Category | developer-tools |\n| Implementation | Registered implementation. Registration alone is not a production-quality guarantee. |\n| Browser execution | Use the visible action or interactive controls. |\n| Browser processing | Browser; see tool notes for network behavior. |\n| HTTP API | Not callable through HTTP. |\n| Browser-agent interface | run_current_tool |\n\n### Implementation notes\n\nRuns in your browser. Paste a 43 to 128 character verifier or leave the box empty to generate one with the browser random number generator.\n\n### Inputs and settings\n\nText input: Code verifier (optional).\n\nExample or placeholder shown in the interface (not a validated fixture):\n\n```text\ndBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk\n```\n\nLeave empty to generate a new verifier, or paste one of 43 to 128 characters. Up to 128 characters. Review the settings before running.\n\n| Setting | Meaning | Control type | Default | Constraints |\n| --- | --- | --- | --- | --- |\n| `method` | Challenge method | select | \"S256\" | Allowed: S256, plain |\n| `length` | Generated verifier length | number | \"64\" | min=43 max=128 step=1 |\n\n### Browser-agent workflow\n\n1. Open the human page in a browser that supports WebMCP.\n2. Discover the interface exposed by that page; use its actual schema.\n3. Select files on the page first when the tool requires files.\n4. Call `run_current_tool` with valid input and settings.\n5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links.\n\nCalls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution.\n\n### Planning specification\n\nInput is one verifier of 43 to 128 characters, or empty to generate one. Hashing and generation run locally in your browser with Web Crypto; nothing is uploaded. Download the JSON report with the verifier, challenge and request parameters.\n\nThis describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support.\n\n### Complete machine-readable capability record\n\n```json\n{\n  \"id\": \"pkce-challenge-generator\",\n  \"category\": \"developer-tools\",\n  \"built\": true,\n  \"requirements\": \"Input is one verifier of 43 to 128 characters, or empty to generate one. Hashing and generation run locally in your browser with Web Crypto; nothing is uploaded. Download the JSON report with the verifier, challenge and request parameters.\",\n  \"implementation\": {\n    \"fields\": [\n      {\n        \"key\": \"method\",\n        \"label\": \"Challenge method\",\n        \"value\": \"S256\",\n        \"type\": \"select\",\n        \"values\": [\n          \"S256\",\n          \"plain\"\n        ]\n      },\n      {\n        \"key\": \"length\",\n        \"label\": \"Generated verifier length\",\n        \"value\": \"64\",\n        \"type\": \"number\",\n        \"min\": 43,\n        \"max\": 128,\n        \"step\": 1\n      }\n    ],\n    \"registrationFamily\": \"crypto-formats-reference\",\n    \"inputMaxLength\": 128,\n    \"inputErrorCode\": \"CRYPTO_FORMATS_REFERENCE_TOO_LONG\",\n    \"note\": \"Runs in your browser. Paste a 43 to 128 character verifier or leave the box empty to generate one with the browser random number generator.\",\n    \"experience\": {\n      \"automatic\": false,\n      \"single\": true,\n      \"inputMaxLength\": 128,\n      \"inputMode\": \"text\",\n      \"label\": \"Code verifier (optional)\",\n      \"placeholder\": \"dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk\",\n      \"help\": \"Leave empty to generate a new verifier, or paste one of 43 to 128 characters. Up to 128 characters. Review the settings before running.\",\n      \"action\": null\n    },\n    \"mode\": \"explicit\",\n    \"interactive\": false\n  },\n  \"execution\": \"Browser interface\",\n  \"api\": null,\n  \"browser_agent\": {\n    \"supported\": true,\n    \"name\": \"run_current_tool\",\n    \"discovery\": \"WebMCP on the human page in a supporting browser\",\n    \"verification\": \"See audit/API-AUDIT.md; availability is not verification\"\n  }\n}\n```\n\n## Page guide\n\nCreate an OAuth PKCE code verifier and its S256 code challenge in your browser. Paste your own verifier to check a challenge, or leave the box empty to generate a new random pair.\n\nHow can we improve this tool?\n\nReport a problem or share an idea.\n\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\n\n### How to use PKCE challenge generator\n\n1. Paste an existing code verifier, or leave the box empty to generate one.\n2. Choose S256 as the challenge method unless your server only supports plain.\n3. Set the length for a generated verifier, from 43 to 128 characters.\n4. Run the tool, copy the challenge into the authorization request and keep the verifier for the token request.\n\n## Useful next steps\n\n- [JWT decoder](https://happytails.ai/en/developer-tools/jwt-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/jwt-decoder.md))\n\n- [HMAC generator](https://happytails.ai/en/developer-tools/hmac-generator/) ([Markdown](https://happytails.ai/en/developer-tools/hmac-generator.md))\n\n- [Password generator](https://happytails.ai/en/privacy-tools/password-generator/) ([Markdown](https://happytails.ai/en/privacy-tools/password-generator.md))\n\n## How the challenge is made\n\nThe tool follows RFC 7636 (OAuth 2.0 PKCE, September 2015). The code challenge for S256 is the Base64url encoding, without padding, of the SHA-256 hash of the ASCII verifier. The result for the verifier in RFC 7636 appendix B matches the published value E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM.\n\n### Generated verifiers\n\nA blank input creates a verifier from the browser cryptographic random number generator, using only the 66 unreserved characters allowed by RFC 7636 and rejection sampling so every character is equally likely.\n\n### Limits\n\nVerifiers must be 43 to 128 characters of letters, digits, hyphen, period, underscore or tilde. The plain method is shown with a warning because it gives no protection if the challenge is intercepted.\n"
}