OAuth 2.0 / PKCE Debugger
OAuth 2.0 / PKCE Debugger
Generate PKCE code_verifier and code_challenge pairs, build a full authorization URL, decode and inspect JWT access tokens with expiry status, and follow the step-by-step Authorization Code + PKCE flow.
OAuth 2.0 / PKCE Debugger
Generate PKCE code_verifier and code_challenge pairs, build a full authorization URL, decode and inspect JWT access tokens with expiry status, and follow the step-by-step Authorization Code + PKCE flow.
Common uses
- Generate a PKCE code challenge for an OAuth flow
- Build an authorization URL for Google OAuth
- Decode and inspect a JWT access token
- Fetch an issuer's OIDC discovery document
Also searched as
- pkce code verifier and challenge generator
- generate code_challenge s256
- oauth2 authorization url builder
- decode oauth access token
- check access token expiry
- oidc discovery document lookup
- openid configuration fetch
- authorization code flow with pkce explained
- oauth client credentials flow example
- oauth device code flow steps
- code_verifier sha256 base64url
Frequently asked questions
How do I generate a PKCE code_challenge from a code_verifier?
The PKCE Generator tab creates a code_verifier and its S256 code_challenge pair that you can use in your authorization request.
How can I build an OAuth authorization URL?
The PKCE Generator tab also has fields for the authorization endpoint, client_id, redirect_uri, scope and state and builds the full authorization URL. The OAuth Flows tab walks through Authorization Code + PKCE, Client Credentials and Device Code.
How do I check whether a JWT access token has expired?
Paste it into the Decode Token tab, which shows the claims and whether the exp claim has passed. Opaque, non-JWT tokens are shown as-is.
How do I look up an issuer's OIDC discovery document?
Use the OIDC Discovery tab to fetch an issuer's discovery document and see its endpoints.
Is my data uploaded to a server?
No. This tool runs entirely in your browser — your input is processed locally on your device and is never uploaded or stored on a server.