2 ms·

But that's fine: having users write it down and/or forgetting it is better than having them compromise their security.