PKCE Generator

// OAuth 2.0 · code_verifier · code_challenge (S256) · state · nonce

Method

Verifier length

PKCE values

code_verifier · keep this in the client; send it only to the token endpoint

code_challenge

state · CSRF protection: compare it when the user comes back

nonce · OpenID Connect: must appear in the returned ID token

Authorization endpoint

Token endpoint

client_id

redirect_uri

scope

1. Send the user to

2. Exchange the returned code (replace AUTH_CODE)

Nothing here is sent anywhere: the URL and request are only built on this page. Generate new values for every login; never reuse a verifier.

code_verifier

code_challenge