PKCE challenge generator
Create an OAuth PKCE code verifier and its S256 code challenge in your browser. Paste your own verifier to check a challenge, or leave the box empty to generate a new random pair.
Input is one verifier of 43 to 128 characters, or empty to generate one. Hashing and generation run locally in your browser with Web Crypto; nothing is uploaded. Download the JSON report with the verifier, challenge and request parameters. Leave empty to generate a new verifier, or paste one of 43 to 128 characters. Up to 128 characters. Review the settings before running.
Your result
How to use PKCE challenge generator
- Paste an existing code verifier, or leave the box empty to generate one.
- Choose S256 as the challenge method unless your server only supports plain.
- Set the length for a generated verifier, from 43 to 128 characters.
- Run the tool, copy the challenge into the authorization request and keep the verifier for the token request.
Useful next steps
How the challenge is made
The tool follows RFC 7636 (OAuth 2.0 PKCE, September 2015). The code challenge for S256 is the Base64url encoding, without padding, of the SHA-256 hash of the ASCII verifier. The result for the verifier in RFC 7636 appendix B matches the published value E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM.
Generated verifiers
A blank input creates a verifier from the browser cryptographic random number generator, using only the 66 unreserved characters allowed by RFC 7636 and rejection sampling so every character is equally likely.
Limits
Verifiers must be 43 to 128 characters of letters, digits, hyphen, period, underscore or tilde. The plain method is shown with a warning because it gives no protection if the challenge is intercepted.