Skip to main content

PKCE Generator

Generate a PKCE code_verifier and its S256 code_challenge, or paste a verifier to compute and check its challenge.

Generated in your browser with the Web Crypto API. Nothing is sent to a server, logged, or stored.
code_verifier
code_challenge (S256 — use this)
—
code_challenge (plain — not recommended)
—

What is PKCE?

Proof Key for Code Exchange (RFC 7636, pronounced "pixy") protects the OAuth authorization code flow. Before redirecting, the client creates a random code_verifier and sends only its hash — the code_challenge — in the authorize request. When it exchanges the code at the token endpoint it sends the verifier, and the server checks that it hashes to the challenge. Someone who steals the code cannot use it without the verifier.

  • code_verifier: 43–128 characters from A–Z a–z 0–9 - . _ ~, with at least 256 bits of randomness.
  • code_challenge (S256): BASE64URL(SHA-256(code_verifier)) — always 43 characters.
  • plain sends the verifier itself as the challenge, which protects nothing if the request is observed. Always use S256.

PKCE is required for public clients such as single-page and mobile apps, and OAuth 2.1 requires it for everyone. In Keycloak you can enforce it per client under Capability config → Require PKCE / PKCE Method. See it in a real flow in the OIDC Playground, or check an existing request with the Authorize URL Inspector.