Codes are computed in your browser. Secrets are stored only in a cookie on this device — nothing is sent to the server.