OAuth 2.1 & PKCE Playground

Generate PKCE pairs, build OAuth 2.1 / OIDC authorization URLs, and export token-exchange curl, fetch, and Axios snippets — 100% in-browser.

Privacy: 100% Client-Side. Your data never leaves this browser tab. Processing uses Web APIs and client-side libraries only.

OAuth 2.1 / PKCE playground — generate S256 pairs, build authorization URLs, and export token-exchange snippets. Everything stays in this tab.

🔒 100% Client-Side Cryptography (Web Crypto API)

Configuration

RFC 7636 PKCE pair via WebCrypto SHA-256 (S256). Verifier length is the Base64URL character count (43–128 recommended).

Verifier length

—

Output

—
—
S256
code_challenge=
code_challenge_method=S256

What is PKCE?

PKCE (Proof Key for Code Exchange) protects the OAuth authorization code flow for public clients by binding the token request to a high-entropy code_verifier and its SHA-256 code_challenge.

This playground generates S256 pairs with WebCrypto, builds ready-to-open authorization URLs, and produces token-endpoint snippets — without sending secrets to a server.

How to use this tool

  1. Generate a code_verifier / code_challenge pair and copy them into your client config.
  2. Use Auth URL Builder to assemble client_id, redirect_uri, scope, state, and PKCE parameters.
  3. Paste an authorization code into Token Exchange to copy curl, fetch, or Axios snippets.

Frequently asked questions

Is the code_verifier uploaded?

No. Generation and hashing run in your browser with the Web Crypto API.

Does this replace a full OAuth RP?

No — use the OAuth / OIDC RP tool for live redirects. This playground focuses on PKCE values, URL construction, and exchange snippets.