Codes are computed on this device and the secret is never stored or sent anywhere. Meant for developers testing 2FA — keep real account secrets in a proper authenticator.