OAuth 2.0 · RFC 7636

Generate your PKCE pair.

Create a cryptographically random code_verifier and its SHA-256 code_challenge for a Proof Key for Code Exchange flow. Everything runs locally in your browser.

01 / Input

Code verifier

43–128 chars

Use each verifier only once. Generated values contain 32 random bytes encoded as URL-safe Base64.

Ready for a verifier.

02 / Output Waiting

Code challenge

Generate a challenge from the verifier on the left.

Send this value as code_challenge with code_challenge_method=S256.

The verifier and challenge never leave this browser tab. Do not paste a verifier into a shared or untrusted environment.

Reference

A small tool for manual OAuth requests.

PKCE binds the authorization request to the later token exchange: the authorization server sees the challenge first, then verifies the original verifier when the client exchanges the authorization code.

Read RFC 7636 View source repo Read the PKCE guide