PKCE Generator — Free Online Code Verifier and Challenge Generator
Generate PKCE code_verifier and code_challenge pairs for OAuth 2.0 Authorization Code + PKCE flow — 100% client-side using Web Crypto API.
Generates a cryptographically random code_verifier (32 bytes → Base64URL) and computes code_challenge = SHA-256(verifier) → Base64URL using the Web Crypto API.
Frequently Asked Questions
PKCE for Secure OAuth 2.0
PKCE (RFC 7636) was introduced to secure OAuth 2.0 Authorization Code flows in scenarios where clients cannot store a client secret securely. This includes native mobile apps, single-page applications, and desktop applications.
The flow works as follows: the client generates a random code_verifier, computes code_challenge = BASE64URL(SHA256(code_verifier)), and sends the challenge in the authorization request. When exchanging the authorization code for tokens, the client sends the original code_verifier. The server verifies the challenge.
This prevents authorization code interception attacks — even if an attacker intercepts the authorization code (e.g., via a malicious app registered to the same redirect URI), they cannot exchange it for tokens without the code_verifier, which never leaves the client.