Stellar Tools · Runs in Your Browser
TOTP Generator
Generate 2FA (TOTP) codes from your secret right in the browser, without installing an authenticator app. Also available through curl for developers in the terminal.
TERMS OF USE
- Use this tool only for your own accounts or accounts you are legitimately authorized to manage. Using it to access other people's accounts without permission is prohibited and may be unlawful.
- You are fully responsible for all use of this tool and its consequences. Stellar is not liable for any misuse or loss arising from the use of this tool.
- Stellar is committed to never storing any credentials on its servers. Secrets and TOTP codes are not stored in any database, cache, or application log.
- Keep your secret confidential. Anyone who knows the secret can generate the same codes.
Secret or otpauth URI
Enter a Base32 secret (e.g. JBSWY3DPEHPK3PXP) or paste an otpauth://totp/... URI
Please accept the terms of use first.
Enter a Secret to Generate Codes
Codes refresh automatically every period and are computed entirely in your browser.
Use from the Terminal (curl)
No app to install. Just run curl from your terminal:
CLI version (curl): a terminal cannot run client-side processing, so the secret is sent over HTTPS to a Stellar server, processed in memory only to generate the code, and discarded immediately without being stored.
TOTP code
curl -s https://stellardigitalinnovations.com/api/totp -d secret=JBSWY3DPEHPK3PXP -d lang=enCode only (for scripts)
curl -s https://stellardigitalinnovations.com/api/totp -d "secret=$TOTP_SECRET" | head -n1With algorithm and digit options
curl -s https://stellardigitalinnovations.com/api/totp -d "secret=$TOTP_SECRET" -d algorithm=SHA256 -d digits=8 -d lang=enFrom an otpauth URI
curl -s https://stellardigitalinnovations.com/api/totp --data-urlencode "uri=otpauth://totp/Akun?secret=JBSWY3DPEHPK3PXP&issuer=Contoh" -d lang=enJSON output
curl -s https://stellardigitalinnovations.com/api/totp -d "secret=$TOTP_SECRET" -H "Accept: application/json" -d lang=enSample response
482913 Valid for : 18 more seconds Next : 105372 Parameters : SHA1 · 6 digits · 30s ------------------------------------------------------------------------ TERMS OF USE 1. Use this tool only for your own accounts or accounts you are legitimately authorized to manage. Using it to access other people's accounts without permission is prohibited and may be unlawful. 2. You are fully responsible for all use of this tool and its consequences. Stellar is not liable for any misuse or loss arising from the use of this tool. 3. Stellar is committed to never storing any credentials on its servers. Secrets and TOTP codes are not stored in any database, cache, or application log. 4. Keep your secret confidential. Anyone who knows the secret can generate the same codes. 5. CLI version (curl): a terminal cannot run client-side processing, so the secret is sent over HTTPS to a Stellar server, processed in memory only to generate the code, and discarded immediately without being stored. ------------------------------------------------------------------------
The secret is accepted only in the POST body. Requests that put the secret in the URL are rejected because URLs may be recorded in server or proxy logs. Limit: 30 requests per minute.
How We Handle Your Secret
- Web version: codes are generated entirely in your browser using the Web Crypto API. Your secret is never sent to Stellar servers.
- CLI version (curl): a terminal cannot run client-side processing, so the secret is sent over HTTPS to a Stellar server, processed in memory only to generate the code, and discarded immediately without being stored.
- Stellar is committed to never storing any credentials on its servers. Secrets and TOTP codes are not stored in any database, cache, or application log.
FAQ
Frequently Asked Questions
TOTP (Time-based One-Time Password, RFC 6238) is a one-time code that changes every 30 seconds and is used for two-factor authentication (2FA). The code is derived from a secret and the current time, just like in Google Authenticator or Microsoft Authenticator.
No. In the web version, codes are computed entirely in your browser and the secret is never sent to the server. In the CLI version, the secret is sent over HTTPS, processed in memory only to generate the code, and discarded immediately without being stored in any database, cache, or application log.
A terminal cannot run client-side processing like a browser, so the computation happens on a Stellar server. The secret is accepted only in the POST body; requests that put the secret in the URL are rejected because URLs may be logged.
Make sure your device clock is in sync (for the web version), and that the algorithm, digits, and period match the service settings. Most services use SHA1, 6 digits, and a 30-second period.
No. Use it only for your own accounts or accounts you are legitimately authorized to manage. You are fully responsible for all use of this tool.
