aaronpkI seem to remember something about the nonce adding to the entropy of the resulting string making it harder to reverse engineer the secret. If that's true, then it wouldn't matter whether the code has expired since you could gather a bunch of codes and analyze them even if they've expired
