The sync password never leaves this device. It is what encrypts the copy kept in the repository, so it must be the same on every device that shares it; the token only opens the repository. It is not the password that opens a vault created on this phone - that one is asked for on the home screen.

The code seals the copy kept on this device. It can be digits or a full password - a longer one is harder to guess, and it is asked for only when the vault opens. Removing it leaves the vault readable by anyone holding the phone unlocked.