OAuth 2.0 PKCE Generator & Auth Flow Sandbox

Generate RFC 7636 Proof Key for Code Exchange (PKCE) code_verifier and SHA-256 code_challenge values, build provider Auth URLs, and inspect callback parameters 100% in browser.

RFC 7636 PKCE Generator (Web Crypto S256)

code_verifier

Cryptographically random high-entropy string (length: {{ codeVerifier.length }} chars).

code_challenge (S256)

Base64URL encoded SHA-256 hash of the code_verifier.

OAuth 2.0 Authorization URL Builder

Provider Preset Authorization Endpoint Client ID (client_id) Redirect URI (redirect_uri) Scope (scope) State Token (state)

Include PKCE (code_challenge & method=S256)

Generated Authorization URL Open URL in Tab

{{ authUrl }}

OAuth 2.0 Token Exchange cURL Request Generator

Token Endpoint Auth Code (code) Client ID Redirect URI Client Secret (confidential clients only)

PKCE lets public clients (SPAs, mobile apps) skip a client secret entirely. Some providers — GitHub OAuth Apps among them — still require client_secret at the token endpoint even when PKCE is used, since their OAuth Apps are inherently confidential clients.

cURL Command for Token Exchange

{{ curlCommand }}

OAuth Callback Response Parser

Paste the callback URL or query string returned after login (e.g. https://example.com/callback?code=AUTH_CODE&state=XYZ).

Auth Code{{ parsedCallback.code }}

State{{ parsedCallback.state }}

Error{{ parsedCallback.error }}

About PKCE & OAuth 2.0 Security

Proof Key for Code Exchange (PKCE, RFC 7636) prevents authorization code injection attacks on single-page web applications (SPAs) and mobile clients. The client creates a secret code_verifier, hashes it into a code_challenge, and proves ownership during token exchange.

OAuth 2.0 PKCE Generator & Auth Flow Sandbox

RFC 7636 PKCE Generator (Web Crypto S256) − + Generate New Pair