The codes are the last six decimal digits of an hmac over the key and the current time (rounded to some boundary, generally 30 seconds). The QR code is the acc

The codes are the last six decimal digits of an hmac over the key and the current time (rounded to some boundary, generally 30 seconds). The QR code is the account's metadata and the preshared key.