The code is good for one hour.
At least 6 characters.
Setting a new password signs every device out, this browser included.