OneTaskBy Tim King · Updated
PKCE Generator
Check the Challenge Your App Computes From a Pasted Verifier
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the OAuth PKCE Generator works
This PKCE generator creates a random OAuth 2.0 code verifier and its S256 code challenge, ready to paste into an authorisation request. Paste a verifier of your own instead and it computes the challenge so you can check what your app produces.
How the PKCE generator builds a challenge
PKCE, Proof Key for Code Exchange, is defined in RFC 7636. The client makes a random verifier of 43 to 128 characters, hashes it with SHA-256, and encodes the hash in base64url without padding. That is the code challenge. It goes in the authorisation request; the verifier stays secret until the token request.
Why PKCE exists
An authorisation code travels through the browser, where another app or a malicious extension might intercept it. PKCE ties the code to the client that asked for it: the server only swaps the code for tokens if the verifier hashes to the challenge it saw earlier. OAuth 2.1 makes PKCE mandatory for every client, including confidential ones.
Common mistakes
Using standard base64 with +, / and = instead of base64url is the usual bug. Hashing the verifier
as hex rather than raw bytes is the second. Using the plain method, where the challenge equals the
verifier, defeats most of the point — always use S256.
FAQ
Can I test my own verifier?
Yes. Paste it into the box and the page computes the S256 challenge. The RFC 7636 example verifier
dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk should give E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM,
which makes a quick self-check.
Which characters can a code verifier use?
Only unreserved URL characters: letters, digits, hyphen, period, underscore and tilde. The length must be between 43 and 128. Anything outside that is rejected by compliant servers, and the page flags it rather than computing a challenge.
Is a generated verifier safe to use in production?
It is random enough, coming from the browser's cryptographic generator, but your app should make its own verifier for every login rather than reuse one copied from a web page. Use this page for testing and debugging.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
OAuth State And Nonce Generator
Random OAuth state and OpenID nonce values for sign-in testing.
JWT Decoder
Decode a JWT and read its claims and expiry.
Hash Generator
Generate MD5, SHA-1, SHA-256 and SHA-512 digests from text.
Base64 Encoder / Decoder
Encode and decode Base64, standard or URL-safe.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.