TOTP computed locally — single or batch, nothing leaves the browser
Computed entirely on-device — the secret never leaves this browser