Just a heads-up:
2FA seems to treat "000001" and "1" the same - while ignoring leading zeroes is not THAT much of a problem (still a large search space), it is still something that could/should be fixed in your backend.