Question 1

What is PKCE and why does OAuth 2.0 need it?

Accepted Answer

PKCE (Proof Key for Code Exchange, RFC 7636) is an OAuth 2.0 extension that protects public clients — SPAs, mobile apps, native CLIs — against authorization code interception. The client picks a secret code_verifier, derives a code_challenge = BASE64URL(SHA-256(verifier)) and sends only the challenge on /authorize; the original verifier is replayed on /token. Any attacker who steals the code cannot exchange it without the verifier.

Question 2

S256 or plain — which challenge method should I use?

Accepted Answer

Always S256. The plain method sends the verifier itself as the challenge, which leaks the secret through server logs, browser history and the Referer header. S256 hashes the verifier with SHA-256 so the challenge is safe to expose. OAuth 2.1 makes S256 mandatory for all Authorization Code flows.

Question 3

What length should my code_verifier be?

Accepted Answer

RFC 7636 allows 43 to 128 characters from the unreserved set [A-Z a-z 0-9 - . _ ~]. 43 characters (32 random bytes base64url-encoded) is the spec minimum and gives ~256 bits of entropy, which is the recommended baseline. 64 chars (48 random bytes) is what Auth0 SPA SDK and MSAL.js default to. Longer verifiers are valid but rarely necessary.

Question 4

Is this PKCE generator safe to use in production?

Accepted Answer

Yes for development, testing and debugging. The tool uses the browser's built-in crypto.getRandomValues() and crypto.subtle.digest() APIs to produce a spec-compliant pair. For production traffic against real users, generate verifiers inside your application code so each session gets a fresh pair bound to that user's request. Never reuse a verifier across sessions.

Question 5

Does this work with Auth0, Okta, Keycloak, Google and Microsoft Entra?

Accepted Answer

Yes. The Authorization Code + PKCE flow is standardized across every modern identity provider — Auth0, Okta, Keycloak, Microsoft Entra ID (Azure AD), Google Identity, AWS Cognito, GitHub Apps, and any other OIDC-compliant server. The verifier and challenge format is identical because RFC 7636 is universal. Just paste the code_challenge into your /authorize URL and replay the code_verifier on /token.

🛠 Build Authorization Request URL

📋 Token Exchange Request Body