Proof Key for Code Exchange (RFC 7636) is an extension to the OAuth2 authorization code flow designed to prevent authorization code interception attacks on public clients.

Does this tool send my code verifier to a server?

No, all generation, hashing, and validation operations run entirely client-side in your browser using the Web Crypto API.

What are the RFC 7636 requirements for a code verifier?

It must be a high-entropy cryptographic string between 43 and 128 characters long, containing only unreserved characters: letters, numbers, hyphens, periods, underscores, and tildes.

What is the difference between code_challenge and code_verifier?

The code_verifier is a secret random string kept on the client, while the code_challenge is the BASE64URL-encoded SHA256 hash of that verifier sent to the authorization server.

Why am I getting an 'invalid_grant' error during token exchange?

This usually happens because the code_verifier sent during the token exchange does not hash to the code_challenge sent during the initial authorization request.

Elysia Tools

Navigation

Security

PKCE Code Verifier & Challenge Generator

Generate, validate and verify OAuth2 / OIDC PKCE (RFC 7636) code_verifier and S256 code_challenge pairs. Three modes: (1) generate a fresh verifier + challenge from cryptographically secure random bytes at 256/384/512/768-bit entropy, (2) audit a verifier you already have against the RFC — length (43–128), charset [A-Za-z0-9-._~] and ≥256-bit entropy, and (3) verify a verifier/challenge pair by recomputing BASE64URL(SHA256(verifier)). Optionally build the full authorization-request URL and token-exchange body. Complements the generic nonce-generator (which only emits a verifier+challenge pair) with RFC-compliance auditing and pair verification.

Details

What this tool helps you do

A focused PKCE (Proof Key for Code Exchange, RFC 7636) tool for OAuth2 / OIDC developers:

Pick a mode: Generate (a fresh pair), Validate (audit a verifier you have), or Verify (check a verifier/challenge pair match).
Generate mode derives a codeverifier from cryptographically secure random bytes (choose 32/48/64/96 bytes = 256/384/512/768 bits) and base64url-encodes it, then computes codechallenge = BASE64URL(SHA256(verifier)). The verifier stays client-side; only the challenge goes to the authorization server.
Validate mode audits an existing verifier against RFC 7636: length 43–128 characters, charset restricted to [A-Za-z0-9-._~], and ≥256 bits of entropy. If compliant it also shows the S256 challenge the verifier implies.
Verify mode recomputes BASE64URL(SHA256(verifier)) and compares it to a provided codechallenge — useful when debugging "invalidgrant" or mismatched challenge errors during the token exchange.
Optionally fill in the authorization endpoint, client ID and redirect URI to build the full authorization-request URL (with codechallengemethod=S256) and the token-exchange body that later sends the secret verifier.

Offline and cryptographically sound: random bytes come from the platform CSPRNG; SHA256 via the crypto module. No network calls, no value leaves the browser.

Execution

Run this tool

Fill in the form, run the tool, and review the result in one place.

Samples

PKCE Code Verifier & Challenge Generator

What this tool helps you do

Run this tool

Examples that match this tool

Continue with connected tools and hubs

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Overview

When to use

How it works

Use cases

Examples

1. Generate a Secure 512-bit PKCE Pair for a Single-Page App

2. Verify a Mismatched PKCE Pair from Server Logs

FAQ

QR Code Samples

Code Comment Samples

Web Image Processing Python Samples

Invalid Variable Names Code Samples

Hash Algorithm Comparator

BIP39 Mnemonic Phrase Generator

Text Hash Generator

OAuth 2.0 / OIDC Authorization Code with PKCE Flow Visualizer