The master password never leaves this device. It is what decrypts the vault; the token only opens the repository.

The code seals the copy kept on this device. Removing it leaves the vault readable by anyone holding the phone unlocked.