Loading…
Generate time-based OTP codes from authenticator secret. Use for 2FA testing; for random tokens use token-generator. Input: Base32 secret. Returns 6-digit code + QR. 100% client-side.
TOTP Generator is loading — interactive editor will appear here. Use examples below to try instantly once loaded.
Press ? for keyboard shortcuts
TOTP (Time-based One-Time Password) generator supporting SHA-1, SHA-256, and SHA-512 hashing algorithms with 6 or 8 digit codes and 30 or 60 second time steps. Displays a live countdown timer, keeps a rolling code history (last 10 codes), includes a cryptographically secure random secret generator, and exports otpauth:// URI for QR codes. Supports Steam TOTP format and multi-account management.
Implementing TOTP authentication requires generating codes with precise timing and algorithm parameters. This tool provides a fully functional TOTP client in the browser for testing, development, and account setup without needing a phone or dedicated authenticator app.
This tool is part of the DevStackIO platform — a collection of free online developer tools from DevStackIO. Browse more free developer resources on DevStackIO.
Security engineers, backend developers implementing 2FA, QA testers validating TOTP flows, and users who need a quick TOTP code without their phone.
Enter a base32-encoded secret (or click Generate Random Secret to create one).
Select the algorithm: SHA-1 (default), SHA-256, or SHA-512.
Set digits to 6 (standard) or 8 (extended) and time step to 30s (standard) or 60s.
View the current TOTP code in large font with a countdown timer showing seconds until the next code.
Check the code history panel to see the last 10 codes with their timestamps.
Switch accounts using the account dropdown or add a new account with the + button.
Input: secret "JBSWY3DPEHPK3PXP" (base32), SHA-1, 6 digits, 30s step → Output: "123456" with 23s countdown timer and otpauth:// URI: otpauth://totp/Example?secret=JBSWY3DPEHPK3PXP&algorithm=SHA1&digits=6&period=30Input: same secret with Steam TOTP format enabled → Output: "ST-12345" (Steam-style 5 character code with leading ST-)What is the difference between TOTP and HOTP?
TOTP is time-based (code changes every 30/60 seconds); HOTP is counter-based (code changes after each use). This tool only generates TOTP codes.
Why does my generated code not match my server?
Check that the secret, algorithm, digits, and time step match exactly. Also verify the server clock is synchronized via NTP.
Can I use this as my primary authenticator?
It is designed for development/testing; for daily use, a dedicated authenticator app with backups is recommended.
What is the Steam TOTP format?
Steam uses a modified TOTP that produces a 5-character alphanumeric code (including digits and letters) prefixed with "ST-" rather than a standard 6-digit numeric code.
Authoritative specifications, standards, and in-depth reading for TOTP Generator.
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes for text. Copy or compare instantly.
Decode SSL certificates (subject/expiry/chain). Use for debugging certs. Input: PEM text ≤10MB. Returns parsed fields. 100% client-side.
Build Content-Security-Policy headers. Use for XSS hardening. Input: directive options. Returns policy string. 100% client-side.
Compute MD5/SHA-256/SHA-512 checksums for files to verify integrity. Use for files; for text strings use hash-generator. Input: file ≤10MB. Returns hex digests. 100% client-side, files never uploaded.
Infer JSON Schema from sample JSON for validation. Use when authoring schemas; for validating instances use json-validator. Input: JSON ≤10MB. Returns JSON Schema draft. 100% client-side.
Hash passwords with bcrypt (cost-configurable) and verify. Use for password storage; for fast checksums use hash-generator, for keyed MACs use hmac-generator. Input: password text. Returns bcrypt hash. 100% client-side.
Generate sortable ULIDs (time-ordered IDs). Use when ordering matters; for random UUIDs use uuid-generator, for tokens use token-generator. Input: count option. Returns ULID strings. 100% client-side.
Compute HMAC-SHA256/SHA512 for message authentication. Use for webhook signatures; for plain hashes use hash-generator. Input: message + secret key. Returns hex HMAC. 100% client-side.