๐ PKCE (code_verifier/challenge) Generator
The code_verifier is generated from the Web Crypto API's cryptographic random number generator, and the code_challenge is its SHA-256 hash, Base64URL-encoded (S256 method).
Generating...
Generate a code_verifier and its corresponding code_challenge (S256 method) for the PKCE (Proof Key for Code Exchange, RFC 7636) extension that protects OAuth 2.0 authorization code flows. The random code_verifier is generated with the browser's Web Crypto API, and the code_challenge is computed by SHA-256 hashing it and Base64URL-encoding the result.
How to use
- A code_verifier and code_challenge pair is generated automatically when the page loads.
- Click "Regenerate" to generate a new pair.
- Use the button next to each value to copy it to the clipboard.
FAQ
What is PKCE?
PKCE (Proof Key for Code Exchange) is an extension to OAuth 2.0's authorization code flow (RFC 7636) that protects against authorization code interception attacks. It's especially recommended for apps that can't safely hold a client secret, such as mobile apps and single-page apps.
How are code_verifier and code_challenge related?
The code_verifier is a randomly generated secret string. The code_challenge is computed by SHA-256 hashing the code_verifier and Base64URL-encoding the result (the S256 method), and is sent to the server in the authorization request. Sending the original code_verifier during token exchange proves the client is the same one that requested the authorization code.
Is this tool's output correct?
The implementation is verified against the official test vector published in RFC 7636 Appendix B.