[jqpabc123]

Generating codes is only half the problem --- and the only part you've addressed.

Securely storing secret keys is the other half --- and the main job of a local 2FA app.