The code is good for one hour.
At least 12 characters.
Setting a new password signs every device out, this browser included.