What is PKCE?
Proof Key for Code Exchange, usually called PKCE, protects an OAuth authorization code flow by binding the authorization request to a temporary secret held by the client. The client creates a code_verifier, derives a code_challenge, sends the challenge with the authorization request, and later proves possession by sending the original verifier to the token endpoint.
S256 challenge calculation
This tool uses the recommended S256 method:
code_challenge = BASE64URL(SHA256(ASCII(code_verifier)))
Base64url output replaces + and / with URL-safe characters and removes trailing padding. The verifier must contain 43–128 unreserved characters. New values are generated with the browser's cryptographically secure random-number API.
How to test an OAuth request
- Generate a fresh verifier and challenge for the request.
- Save the verifier in short-lived client state; do not place it in the authorization URL.
- Send the challenge and
code_challenge_method=S256 to the authorization endpoint.
- After receiving the authorization code, send the verifier to the token endpoint.
- Discard the verifier after the exchange finishes.
The URL builder is for inspection and testing. It does not open the authorization endpoint or exchange a code for tokens.
Privacy and security
Generation, hashing, verification, and URL assembly happen in your browser. MiniUtil does not receive the verifier, challenge, client ID, redirect URI, or scope. Treat generated values as temporary testing material and generate a unique verifier for each authorization request.
PKCE does not replace TLS, redirect URI validation, client authentication where applicable, or a state value used to bind the browser response to the initiating session.
Standard and related tools
The implementation follows RFC 7636, including the S256 transformation and verifier length rules. Use the Base64 Encoder and Decoder to inspect other encodings, the Hash Generator for general message digests, or the JWT Decoder when debugging returned identity tokens.