OAuth 2.0 PKCE (S256)

Client

Proof Key for Code Exchange adds a per-request secret to the authorization code flow. This page mints a code_verifier and derives code_challenge with SHA-256 and base64url, matching RFC 7636 for S256.

Flow reminder

On the authorization request you send code_challenge and code_challenge_method=S256. On the token request you send the original code_verifier so the server can hash it and compare. JWTs are a different layer—use JWT decode only to inspect tokens after issuance.

Encoding reference

Base64url without padding is also used in JWTs and JWKs. Compare with the Base64url encoder if you need arbitrary text, not just PKCE.

Local only: verifiers use crypto.getRandomValues; challenges use Web Crypto SHA-256. Nothing is sent to Toolcore—pair these values with your OAuth client in your own app.
?

RFC 7636: send code_challenge and code_challenge_method=S256 in the authorize request; send code_verifier with the token exchange. Verifier length 43–128 after generation.

Common use cases

  • Prototype public OAuth clients (SPAs, mobile) that must not use a client secret in the bundle.
  • Sanity-check that your stack’s base64url output matches S256 before wiring the token endpoint.
  • Debug authorization servers that reject challenges—compare a fresh pair against server logs.
  • Teach PKCE: show how a one-time verifier maps to a challenge without exposing secrets.

Common mistakes to avoid

  • Reusing the same verifier across users or sessions

    Generate a new verifier per authorization attempt; treat it like a nonce tied to one login flow.

  • Sending plain in authorize URL

    Send code_challenge and code_challenge_method=S256 on authorize; send code_verifier only on the token request over HTTPS.

  • Mixing up base64 and base64url

    PKCE requires URL-safe base64 without padding. This page matches RFC 7636 / OpenID conventions.

FAQ

Does Toolcore see my verifier?

No. Random bytes and hashing run in your tab; we do not POST them anywhere.

Is this the same algorithm as OpenID Connect?

S256 is the standard PKCE method OIDC references; always confirm your IdP supports S256.

Can I paste my own verifier?

Yes—edit the field or use ?q= / ?qb= prefill. The challenge updates when the verifier satisfies length and character rules.

Common search terms

Phrases people search for that match this tool. See the full long-tail keyword index.

  • pkce code verifier generator
  • oauth2 s256 code challenge online
  • rfc 7636 pkce in browser
  • generate code challenge sha256 base64url

More tools

Related utilities you can open in another tab—mostly client-side.