Your files stay on your device

# PKCE verifier and challenge

Generate an RFC 7636 code_verifier / code_challenge pair, or check a pair against each other, in plain and S256 forms, with CSPRNG values made in your tab.
S256 (SHA-256, use this)plain (no hash; only if the server cannot do S256)Verifier length436486128

RFC 7636 §4.1: 43 characters is the 256-bit minimum.
Generate pairAuthorization endpointclient_idredirect_uriscopestatenoncecode_verifiercode_challengeCheck pairPaste, drop, or type to begin. Everything stays on this device.

## More web & auth tools

- [JWT decoder](/web/jwt)
- [Authorization header](/web/auth-header)
[All web & auth tools](/web)

---

Canonical HTML: https://nutter.tools/web/pkce/
Markdown version: https://nutter.tools/web/pkce/index.md
Plain-text version: https://nutter.tools/web/pkce/index.txt
Agent index: https://nutter.tools/llms.txt