PKCE Code Verifier & Challenge Generator Field Guide: When Three Modes, One RFC 7636 Rule, and One SHA-256 Round-Trip Decide Whether Your OAuth SPA Flow Lands on Token Exchange or on an invalid_grant Toast

Generate, audit, and verify RFC 7636 code_verifier and code_challenge pairs side by side. Covers the three modes, the five rules the RFC enforces, the round-trip across the authorization code flow, and the pitfalls the spec lets through.