PKCE hashes a code verifier (43 to 128 characters) into a code challenge using SHA-256 and base64url encoding.