The data is a one-time password. Usually this can be treated as no secret, but the implementer might still choose to mask the input.