Proof Key for Code Exchange — an OAuth 2.0 extension that prevents authorization code interception attacks. Required for mobile apps and SPAs.

What does the tool generate?

code_verifier (random 43-128 char string), code_challenge (SHA-256 of the verifier, base64-url-encoded), and state (CSRF protection token).

code_challenge on the /authorize request; code_verifier on the /token request. state is a round-trip parameter to prevent CSRF.

Why SHA-256 for the challenge?

The 'S256' method. There's also 'plain' (just use verifier as challenge) but it's not secure. Always use S256.

OAuth PKCE Generator | DevTools Surf

DevTools Surf

Example: OAuth PKCE Generator

A worked example, rendered from real sample data. Sign in to run the tool on your own input.

Input

generate

Output

code_verifier:         a4~tU-OVjL_NCBiwBL9h~YuB.EVrHrnA3tKCT.IfbjCkL~QeBul74MKTMTa9iuSB
code_challenge:        emNlvascvRz5hLDfK0utiwDV_imXNXxlkLDWKgxPOG0
code_challenge_method: S256
state:                 82uk7r7Xq0g4oufcW_sV5A
nonce:                 Y8tPwBvUqrD05AlUYb6ZXw

Authorization request parameters:
response_type=code&state=82uk7r7Xq0g4oufcW_sV5A&code_challenge=emNlvascvRz5hLDfK0utiwDV_imXNXxlkLDWKgxPOG0&code_challenge_method=S256

Token exchange:
curl -X POST 'https://issuer.example.com/oauth2/token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d grant_type=authorization_code \
  -d code=THE_CODE_FROM_THE_REDIRECT \
  -d 'redirect_uri=https://app.example.com/callback' \
  -d 'client_id=YOUR_CLIENT_ID' \
  -d 'code_verifier=a4~tU-OVjL_NCBiwBL9h~YuB.EVrHrnA3tKCT.IfbjCkL~QeBul74MKTMTa9iuSB'

About OAuth PKCE Generator

OAuth PKCE Generator preview - Security / Crypto tool

Generate PKCE parameters with S256/plain support, state, and nonce. Includes OAuth flow examples. Part of the DevTools Surf developer suite. Browse more tools in the Security / Crypto collection.

Use Cases

Generating PKCE parameters for single-page application OAuth flows
Testing OAuth authorization code flow with PKCE in development
Creating code challenge pairs for mobile app authentication
Debugging PKCE verification failures in OAuth server logs

Tips

Generate a fresh code_verifier and code_challenge pair per flow
Use S256 challenge method instead of plain for security
Copy the state parameter to prevent cross-site request forgery

Fun Facts

PKCE (RFC 7636) was published in September 2015 and was originally designed to protect mobile apps from authorization code interception.
The acronym PKCE is pronounced 'pixy' and stands for Proof Key for Code Exchange.
OAuth 2.1 (draft) mandates PKCE for all OAuth clients, not just mobile apps, making it a universal security requirement.

FAQ

What is PKCE?: Proof Key for Code Exchange — an OAuth 2.0 extension that prevents authorization code interception attacks. Required for mobile apps and SPAs.
What does the tool generate?: code_verifier (random 43-128 char string), code_challenge (SHA-256 of the verifier, base64-url-encoded), and state (CSRF protection token).
Where do these go?: code_challenge on the /authorize request; code_verifier on the /token request. state is a round-trip parameter to prevent CSRF.
Why SHA-256 for the challenge?: The 'S256' method. There's also 'plain' (just use verifier as challenge) but it's not secure. Always use S256.

Related Security / Crypto Tools

Hash Generator v2 HMAC Generator v2 JWT Encoder Bcrypt Hash Tester HMAC Generator Password Strength Analyzer TOTP / 2FA Generator SAML Response Decoder