# PKCE challenge generator

- Human page: https://happytails.ai/en/developer-tools/pkce-challenge-generator/
- Markdown: https://happytails.ai/en/developer-tools/pkce-challenge-generator.md
- Structured JSON: https://happytails.ai/agents/en/developer-tools/pkce-challenge-generator/index.json
- Visibility: public

## Tool capabilities

| Property | Value |
| --- | --- |
| Tool ID | `pkce-challenge-generator` |
| Category | developer-tools |
| Implementation | Registered implementation. Registration alone is not a production-quality guarantee. |
| Browser execution | Use the visible action or interactive controls. |
| Browser processing | Browser; see tool notes for network behavior. |
| HTTP API | Not callable through HTTP. |
| Browser-agent interface | run_current_tool |

### Implementation notes

Runs in your browser. Paste a 43 to 128 character verifier or leave the box empty to generate one with the browser random number generator.

### Inputs and settings

Text input: Code verifier (optional).

Example or placeholder shown in the interface (not a validated fixture):

```text
dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk
```

Leave empty to generate a new verifier, or paste one of 43 to 128 characters. Up to 128 characters. Review the settings before running.

| Setting | Meaning | Control type | Default | Constraints |
| --- | --- | --- | --- | --- |
| `method` | Challenge method | select | "S256" | Allowed: S256, plain |
| `length` | Generated verifier length | number | "64" | min=43 max=128 step=1 |

### Browser-agent workflow

1. Open the human page in a browser that supports WebMCP.
2. Discover the interface exposed by that page; use its actual schema.
3. Select files on the page first when the tool requires files.
4. Call `run_current_tool` with valid input and settings.
5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links.

Calls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution.

### Planning specification

Input is one verifier of 43 to 128 characters, or empty to generate one. Hashing and generation run locally in your browser with Web Crypto; nothing is uploaded. Download the JSON report with the verifier, challenge and request parameters.

This describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support.

### Complete machine-readable capability record

```json
{
  "id": "pkce-challenge-generator",
  "category": "developer-tools",
  "built": true,
  "requirements": "Input is one verifier of 43 to 128 characters, or empty to generate one. Hashing and generation run locally in your browser with Web Crypto; nothing is uploaded. Download the JSON report with the verifier, challenge and request parameters.",
  "implementation": {
    "fields": [
      {
        "key": "method",
        "label": "Challenge method",
        "value": "S256",
        "type": "select",
        "values": [
          "S256",
          "plain"
        ]
      },
      {
        "key": "length",
        "label": "Generated verifier length",
        "value": "64",
        "type": "number",
        "min": 43,
        "max": 128,
        "step": 1
      }
    ],
    "registrationFamily": "crypto-formats-reference",
    "inputMaxLength": 128,
    "inputErrorCode": "CRYPTO_FORMATS_REFERENCE_TOO_LONG",
    "note": "Runs in your browser. Paste a 43 to 128 character verifier or leave the box empty to generate one with the browser random number generator.",
    "experience": {
      "automatic": false,
      "single": true,
      "inputMaxLength": 128,
      "inputMode": "text",
      "label": "Code verifier (optional)",
      "placeholder": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk",
      "help": "Leave empty to generate a new verifier, or paste one of 43 to 128 characters. Up to 128 characters. Review the settings before running.",
      "action": null
    },
    "mode": "explicit",
    "interactive": false
  },
  "execution": "Browser interface",
  "api": null,
  "browser_agent": {
    "supported": true,
    "name": "run_current_tool",
    "discovery": "WebMCP on the human page in a supporting browser",
    "verification": "See audit/API-AUDIT.md; availability is not verification"
  }
}
```

## Page guide

Create an OAuth PKCE code verifier and its S256 code challenge in your browser. Paste your own verifier to check a challenge, or leave the box empty to generate a new random pair.

How can we improve this tool?

Report a problem or share an idea.

Please leave out private information. Your message and the tool name go to our team via PostHog.

### How to use PKCE challenge generator

1. Paste an existing code verifier, or leave the box empty to generate one.
2. Choose S256 as the challenge method unless your server only supports plain.
3. Set the length for a generated verifier, from 43 to 128 characters.
4. Run the tool, copy the challenge into the authorization request and keep the verifier for the token request.

## Useful next steps

- [JWT decoder](https://happytails.ai/en/developer-tools/jwt-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/jwt-decoder.md))

- [HMAC generator](https://happytails.ai/en/developer-tools/hmac-generator/) ([Markdown](https://happytails.ai/en/developer-tools/hmac-generator.md))

- [Password generator](https://happytails.ai/en/privacy-tools/password-generator/) ([Markdown](https://happytails.ai/en/privacy-tools/password-generator.md))

## How the challenge is made

The tool follows RFC 7636 (OAuth 2.0 PKCE, September 2015). The code challenge for S256 is the Base64url encoding, without padding, of the SHA-256 hash of the ASCII verifier. The result for the verifier in RFC 7636 appendix B matches the published value E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM.

### Generated verifiers

A blank input creates a verifier from the browser cryptographic random number generator, using only the 66 unreserved characters allowed by RFC 7636 and rejection sampling so every character is equally likely.

### Limits

Verifiers must be 43 to 128 characters of letters, digits, hyphen, period, underscore or tilde. The plain method is shown with a warning because it gives no protection if the challenge is intercepted.