OAuth PKCE Pair Generator

Mobile apps and SPAs have nowhere safe to keep a client_secret, and the authorization code coming back on the redirect can be intercepted by another app registered for the same URL scheme. PKCE fixes that by binding the code to a secret only the client knows. This page generates the full pair: a random code_verifier and its matching SHA-256 code_challenge, ready to drop into a manual flow test.

The verifier comes from crypto.getRandomValues bytes encoded as base64url. The length field is clamped between 32 and 96 bytes, which is not arbitrary: 32 bytes produce exactly 43 characters, the RFC 7636 minimum, and 96 bytes produce 128, the maximum. The challenge is the base64url SHA-256 of the verifier and always lands at 43 characters. One thing that breaks home-grown implementations: the hash is taken over the ASCII text of the verifier, not over the original random bytes.

Use the pair to walk a flow by hand with curl or Postman, or to confirm your own code derives the same challenge from the same verifier. In a real app the verifier has to be created inside the client itself, a fresh one per authorization request, and thrown away once the token comes back. The plain method exists in the spec, but only for platforms without SHA-256, so use S256. Generation happens in your browser and nothing is sent anywhere.