# OAuth / PKCE Studio — Code Verifier, Challenge & Auth URL

Generate a PKCE code\_verifier or check one you paste, then compute the S256 code\_challenge. Build the authorization request URL, and check whether the state in the callback matches the one you sent. PKCE is for public clients and needs no client\_secret. Token exchange needs network access, so this tool only shows the curl command.

- URL: https://tools.itlibra.com/en/oauth-pkce-studio
- On-device・No upload
- Last updated: 2026-10-26

## How to use

1. Click “Generate” to create a code\_verifier, state and nonce together. A code\_verifier you paste is checked for length (43–128) and allowed characters.
2. The code\_challenge is shown as S256: the base64url of the SHA-256 of the code\_verifier. Do not use plain.
3. Enter the authorization endpoint, client\_id, redirect\_uri and scope to get the authorization request URL. This tool does not open it, so copy it and paste it into a browser yourself.
4. Paste the URL the authorization server redirected to (or the part after “?”). The code, state and error are read out, and the state is compared with the one you sent.
5. After the state matches, enter the token endpoint to show the curl command. The tool does not send it, so run the command on your own machine.

## Use cases

- Check the PKCE values (verifier and challenge) by hand in an authorization code flow for a SPA or mobile app
- Find out why a code\_challenge does not match, by checking length, characters and the S256 step in turn
- See whether each parameter in an authorization URL is encoded correctly
- Read whether the state in a returned URL matches, and what an error response means

## What it does

### Generate and check the code\_verifier

Creates a 43–128 character value with crypto.getRandomValues. A pasted value is checked for length and for the unreserved characters (letters, digits, - . \_ \~). Bad characters are shown by code point (U+), not by position.

### S256 code\_challenge

Computes the SHA-256 of the code\_verifier and encodes it as base64url without padding. A unit test checks it against the RFC 7636 Appendix B example.

### Authorization request URL

Builds response\_type, client\_id, redirect\_uri, scope, state, nonce (for OIDC), and code\_challenge. Spaces are written as %20. The URL is never opened or sent.

### Reads the callback and checks the state

Takes code, state, error, error\_description and iss from the returned URL. A state that differs from the one sent is flagged as a possible CSRF attempt.

### Explains error responses

Shows the RFC 6749 §4.1.2.1 error codes (such as access\_denied) with what they mean and what to do next.

### Secrets hidden by default

The code\_verifier, code and curl output are masked on screen. Nothing is saved to localStorage or elsewhere, and closing the page clears everything.


## Capability matrix

| Feature | Support | Notes |
| --- | --- | --- |
| code\_verifier generation (43–128 characters, cryptographic random) | Supported | — |
| code\_verifier check (length and allowed characters) | Supported | — |
| code\_challenge (S256) calculation | Supported | — |
| code\_challenge\_method=plain calculation | Partial | It can be calculated, but we advise against using it (RFC 7636 §4.2) |
| Authorization request URL | Supported | Only builds the string. It does not open or send it |
| OpenID Connect nonce | Supported | — |
| Reading the callback URL and checking state | Supported | — |
| Fetching the server metadata (discovery) | Not supported | No network requests. Enter the endpoints yourself |
| Getting a token (running the exchange) | Not supported | No network requests. The tool only shows the curl command |
| Entering a client\_secret | Not supported | PKCE is for public clients. client\_secret is not handled |
| ID token or JWT signature check, iss matching | Not supported | iss is only shown; the tool does not check whether it is right |
| Extensions such as PAR, JAR and DPoP | Not supported | These specifications are not handled |

## Limits & notes

- A code\_verifier must be 43–128 characters (RFC 7636 §4.1). Values outside that range are neither calculated nor generated.
- The authorization endpoint and redirect\_uri are https URLs of up to 2,048 characters (http is allowed for localhost during development). A URL with # is not accepted (RFC 6749 §3.1).
- A pasted callback can be up to 20,000 characters.
- The SHA-256 (WebCrypto) runs only on pages served over https or on localhost.
- This is a client-side check. It cannot confirm how the authorization server matches requests or issues tokens.

## Privacy & safety

The code\_verifier, state, callback URL and authorization URL are processed only in your browser and are never sent to or stored on a server. The code\_verifier, code and curl output are masked by default, and closing the page clears everything.

## FAQ

### What is the relationship between code\_verifier and code\_challenge?

The code\_verifier is a secret string made on your device. With S256, the code\_challenge is the base64url of its SHA-256 (RFC 7636 §4.2). The authorization request carries the code\_challenge, and the token request carries the code\_verifier. The server checks that they match.

### Should I use S256 or plain?

Use S256. With plain, the code\_challenge and code\_verifier are the same value, so anyone who sees the authorization URL also learns the code\_verifier. RFC 7636 §4.2 says to use S256 whenever the client can.

### What is state for, and what happens if it does not match?

state is a random value that ties a request to its response, which protects against CSRF (forged requests) (RFC 6749 §10.12). If the state in the returned URL differs from the one you sent, do not use that response.

### Why is there no client\_secret field?

PKCE is for public clients such as SPAs, mobile apps and desktop apps, which cannot keep a secret. It protects the authorization code without a client\_secret. If your server can keep a secret, follow the authorization server’s documentation for how to use it.

### Can this tool get a token?

No. The tool does not connect to any server. It only shows a curl command that sends the code and code\_verifier to the token endpoint (grant\_type=authorization\_code; RFC 6749 §4.1.3 and RFC 7636 §4.5). You can convert the curl command with the curl converter.

### When is a nonce needed?

With OpenID Connect, a nonce stops an ID token from being replayed (OIDC Core §3.1.2.1). It is optional in the authorization code flow. If you send one, the receiving side should check that it matches the nonce in the ID token. This tool does not check ID tokens.