By · Updated

OAuth State Generator

Random OpenID Connect Nonce and CSRF State Values in Base64url or Hex

No ratings yet

OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.

How the OAuth State and Nonce Generator works

This OAuth state generator makes a random state value and a matching OpenID Connect nonce from the browser's cryptographic random source. Choose how many bytes and whether you want base64url or hex, and copy them straight into a test authorisation request.

What the OAuth state generator values do

The state parameter protects the redirect back to your app from cross-site request forgery. You store it before sending the user to the provider and refuse the callback unless it comes back unchanged. The nonce does a similar job for the ID token in OpenID Connect: it is copied into the signed token, so a token captured from another login cannot be replayed into yours.

How long they should be

Both must be unguessable. 16 random bytes (128 bits) is the floor most guidance sets, and 32 bytes is common. Base64url keeps them short and safe in a URL without escaping; hex is easier to eyeball in logs.

Using them correctly

Generate fresh values for every login, bind them to the user's session, check them once and throw them away. A state that is fixed, derived from the user id, or reused across sessions gives no protection.

FAQ

What is the difference between state and nonce?

State is checked by your app when the browser returns from the provider, and protects the redirect. Nonce is checked inside the ID token after you receive it, and protects the token. OpenID Connect flows should use both; plain OAuth only has state.

Can I use PKCE instead of state?

PKCE protects the authorisation code from being swapped, and OAuth 2.1 says it can stand in for state's CSRF role when the server enforces it. Most libraries still send state too, and it costs nothing, so keep it unless you have a reason not to.

Are these values safe to use in production?

They are generated with crypto.getRandomValues and never leave the page, but a real app must create its own per-login values in code. Use these for building requests by hand, testing a provider, or writing documentation examples.

See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.

Related tools

OAuth PKCE Generator

PKCE code verifier and S256 challenge for OAuth 2.0 testing.

Random String Generator

Cryptographically random strings in any length and character set.

JWT Decoder

Decode a JWT and read its claims and expiry.

API Key Generator

Random prefixed API keys with an optional checksum, like GitHub tokens.

.env File Checker

Lint a .env file for syntax errors, duplicates and weak secrets.