What is a PKCE code verifier?
It is a cryptographically random, temporary secret created for one authorization request. The client later sends it to the token endpoint so the server can compare it with the earlier challenge.
PKCE Generator & Verifier
Generate RFC 7636 code verifiers and S256 challenges, or verify an existing verifier/challenge pair. Values stay in this browser tab and are never added to a URL automatically.
Generate or verify a PKCE pair
Secure randomness and SHA-256 run in a browser worker. Verifiers are not persisted, uploaded, included in analytics, or inserted into authorization URLs.
S256 derives a 43-character, padding-free Base64URL challenge from the SHA-256 digest of the verifier. It is the recommended and default method.
RFC 7636 allows 43–128 characters. The generator samples the allowed A–Z, a–z, 0–9, -, ., _, and ~ characters with crypto.getRandomValues().
PKCE result
The verifier, derived challenge, method, lengths, and verification result will appear here.
Prepare and debug OAuth PKCE values
Generate a new verifier/challenge pair for an authorization request or reproduce a challenge from an existing verifier while debugging an OAuth or OpenID Connect integration. DecodeLens compares values only; it does not contact an authorization server.
PKCE boundaries
- S256 uses SHA-256 and padding-free Base64URL exactly as defined by RFC 7636; it is always the default.
- plain is available only for explicit compatibility checks and is never selected as an automatic fallback.
- Verification proves that the two entered values correspond. It does not prove that an authorization server stored, accepted, or redeemed them.
- Generated verifiers exist only in the current page state. Reloading or closing the tab removes them.
Related tools for this workflow
Continue with tools that decode, convert, inspect, or verify the same data.
- Security & identity
JWT Decoder & Parser
Parse JWT segments and inspect formatted Header, Payload, and Signature data locally.
Open tool - Developer utilities
URL Parser & Builder
Inspect URL components and query parameters, edit them, and rebuild a valid URL.
Open tool - Encoded data
Base64 Decoder & Encoder
Decode Base64 text or files, or encode UTF-8 text and raw file bytes locally.
Open tool - Verification
MD5 & SHA Hash Generator / Verifier
Generate and compare MD5, SHA-256, SHA-384, or SHA-512 hashes from text and files.
Open tool
Add PKCE to an authorization-code request
Generate a pair, send code_challenge and code_challenge_method=S256 with the authorization request, then send code_verifier in the token request body after receiving the authorization code.
Authorization request
code_challenge=E9Melhoa…&code_challenge_method=S256Token request body
grant_type=authorization_code&code_verifier=dBjftJeZ4…PKCE Generator & Verifier FAQ
Should I use S256 or plain?
Use S256. RFC 7636 requires clients capable of S256 to use it, and current OAuth security guidance treats downgrade behavior as unsafe. plain is retained only for known compatibility requirements.
Is the code verifier sent in the authorization URL?
No. The authorization request contains the challenge and method. The verifier is sent later in the token request body and should not be exposed in a URL.