Do we even need letters in the code? Are number only codes preferred? Article: https://www.gregoryschmidt.com/articles/two-factor-design