PKCE Playground

Generate high-entropy `code_verifier` and S256 `code_challenge` pairs for OAuth PKCE flows — 100% in-browser.

Privacy: 100% Client-Side. Your data never leaves this browser tab. Processing uses Web APIs and client-side libraries only.

PKCE playground for generating RFC 7636 `code_verifier` and S256 `code_challenge` pairs locally in your browser.

🔒 100% Client-Side Cryptography (Web Crypto API)

Configuration

RFC 7636 PKCE pair via WebCrypto SHA-256 (S256). Verifier length is the Base64URL character count (43–128 recommended).

Verifier length

—

Output

—
—
S256
code_challenge=
code_challenge_method=S256

What is PKCE?

PKCE (Proof Key for Code Exchange) protects the OAuth authorization code flow for public clients by binding the token request to a high-entropy code_verifier and its SHA-256 code_challenge.

This playground focuses on local PKCE generation with WebCrypto so you can copy verifier/challenge pairs into your OAuth client, SPA, mobile app, or test flow without sending data to a server.

How to use this tool

  1. Generate a code_verifier / code_challenge pair and copy them into your client config.
  2. Send the challenge in your authorization request and retain the verifier for the token request.
  3. Use the OAuth / OIDC RP tool when you want to run the full redirect and token flow end to end.

Frequently asked questions

Is the code_verifier uploaded?

No. Generation and hashing run in your browser with the Web Crypto API.

Does this run the full OAuth flow?

No. This page is intentionally limited to PKCE value generation. Use the OAuth / OIDC RP tool for live authorization requests, callbacks, and token exchange.