Passwords are scrypt-hashed server-side and the TOTP secret never leaves the container environment. “Remember this device” stores only a hashed, revocable token — never your password.