Passwords are hashed, codes expire in 10 minutes, and sessions stay on this device.