Generate PKCE code_verifier and code_challenge pairs for OAuth 2.0 authorization code flow with S256 method.
This OAuth-specific generator prepares the two values that bind an authorization request to its later code exchange. It creates a PKCE code_verifier and computes the matching S256 code_challenge as the unpadded base64url representation of the verifier's SHA-256 digest. Generation stays in the browser, so the verifier is not uploaded. A frequent mistake is treating the challenge as another random value. It is derived from the verifier, and even a case change or extra character produces a different challenge.
A valid PKCE code_verifier is case-sensitive and 43 through 128 characters long. Its allowed characters are ASCII letters, digits, hyphen, period, underscore, and tilde. A client uses the verifier for one pending authorization transaction. The matching challenge goes in the authorization request, while the original verifier must be retained for the later token request.
With S256, code_challenge equals BASE64URL-ENCODE(SHA256(ASCII(code_verifier))). SHA-256 first produces 32 bytes. Base64url represents those bytes with its URL-safe alphabet, and trailing equals-sign padding is omitted. Send the result as code_challenge with code_challenge_method set to S256. During code redemption, the authorization server repeats this derivation from code_verifier and performs the PKCE comparison.
No. Generate a new verifier and challenge for each authorization request. Reuse can confuse concurrent attempts and weakens the intended binding between one authorization request and its code exchange. Store the verifier with the matching pending transaction, then discard it after successful redemption or when that transaction is abandoned.
Put code_challenge and code_challenge_method=S256 in the authorization request. Keep code_verifier in the initiating client until the authorization code is returned, then include it in the token request. Do not place the verifier in the authorization URL. PKCE protects the exchange because a party holding only an intercepted code should not also possess the verifier.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.