PKCE (RFC 7636) is an OAuth 2.0 security extension that protects public and confidential clients against authorization code interception attacks using SHA-256 challenges.
PKCE (pronounced "pixy", RFC 7636) is an extension to the OAuth 2.0 Authorization Code Flow designed to prevent authorization code interception attacks on public clients (Single-Page Apps and mobile apps) that cannot securely store client secrets.
Generate SHA-256 code challenges with our Hash Generator, encode challenge strings with Base64 Converter, or inspect issued access tokens with the JWT Decoder.
| Specification | Details |
|---|---|
| RFC Standard | RFC 7636 |
| Target Clients | Public Clients (React/Vue SPAs, iOS, Android, Electron) & Confidential Clients |
| Code Verifier | High-entropy cryptographic random string (43 to 128 characters, [A-Z, a-z, 0-9, -._~]) |
| Code Challenge | BASE64URL(SHA256(code_verifier)) for code_challenge_method = S256 |
| Mandatory in | OAuth 2.1 Draft Specification |
code_verifier) using the Web Crypto API.code_challenge = Base64Url(SHA256(code_verifier))./authorize with code_challenge and code_challenge_method=S256.code_verifier to /token.SHA256(code_verifier) and verifies it matches the stored challenge before releasing the access token.code_challenge_method=plain?The plain method sends the raw verifier during the initial authorization redirect without cryptographic hashing, rendering it vulnerable to interception by malicious OS-level URL scheme interceptors. Modern identity providers require S256.
Free, browser-based utilities to test, generate, and inspect Proof Key for Code Exchange (PKCE) payloads directly.
Generate and verify cryptographic hashes with multiple algorithms.
Encode and decode Base64 strings, files, and data URIs instantly.
Decode, inspect, and validate JWT tokens with claim and signature analysis.
Encode, decode, and parse URLs and query strings instantly.