PKCE code verifier and challenge

Generate an OAuth 2.0 PKCE code verifier and its S256 code challenge, on your device, for an authorization code flow.

PKCE code verifier and challenge draws 32 random bytes with crypto.getRandomValues, base64url-encodes them as code_verifier, then SHA-256 hashes and base64url-encodes that string again as code_challenge. Only the S256 challenge method is offered, since every current OAuth guidance recommends it over the legacy plain method. There are no options, so a fresh, unrelated pair comes out on every run.

Questions

What challenge method does it use?

Only S256, the SHA-256-based method every current OAuth guidance recommends over the legacy plain method.

How is code_verifier generated?

32 random bytes from crypto.getRandomValues, base64url-encoded.

How is code_challenge computed?

SHA-256 of the verifier string, then base64url-encoded again.

What options can I set?

None; every run produces a fresh, unrelated pair.

What is this used for?

RFC 7636 Proof Key for Code Exchange, used in an OAuth 2.0 authorization code flow to prevent code interception.

Related Security tools

·→1CVSS calculatorParse a CVSS 3.1 or 4.0 vector string and compute its base score and severity, on your device. 3.1 matches the published formula exactly; 4.0 approximates FIRST's severity table.·→1CSP evaluatorCheck a Content-Security-Policy header for unsafe-inline/eval, wildcard sources, and missing default-src, object-src, or base-uri.·→1SPF / DMARC / DKIM record parserBreak an SPF, DMARC, or DKIM TXT record into its mechanisms or tags, on your device, with weak-configuration warnings.1→1security.txt checkerCheck a security.txt file against RFC 9116: required fields, an expired Expires date, and recommended Canonical and Encryption lines.·→1Set-Cookie header parserBreak one or more Set-Cookie header lines into name, attributes, and flags, on your device, with common misconfiguration warnings.·→1URL unfurlBreak a URL into its scheme, punycode-decoded host, and query parameters, on your device, decoding base64-looking values and nested redirect URLs.·→1Webhook HMAC signature verifyCheck a webhook payload against its HMAC signature, on your device, including Stripe and GitHub header formats.