RFC 7636 §4.1: code_verifier is a "high-entropy cryptographic random
STRING using the unreserved characters [A-Z] / [a-z] / [0-9] / "-" / "."
/ "_" / "~" ... with a minimum length of 43 characters and a maximum
length of 128 characters". byteLength random bytes, base64url-encoded,
yields ceil(byteLength * 8 / 6) characters drawn from a subset of that
unreserved set (no padding, since base64url omits it) — 32 bytes (the
default) is the smallest input that reaches the 43-character floor; 96
bytes reaches the 128-character ceiling.
RFC 7636 §4.1:
code_verifieris a "high-entropy cryptographic random STRING using the unreserved characters [A-Z] / [a-z] / [0-9] / "-" / "." / "_" / "~" ... with a minimum length of 43 characters and a maximum length of 128 characters".byteLengthrandom bytes, base64url-encoded, yieldsceil(byteLength * 8 / 6)characters drawn from a subset of that unreserved set (no padding, since base64url omits it) — 32 bytes (the default) is the smallest input that reaches the 43-character floor; 96 bytes reaches the 128-character ceiling.