Wrong code entries so far.
Salted, server-keyed HMAC-SHA-256 (base64url) of the typed code.
Random per-verification salt for PendingVerification.CodeHash.
The address the link and code were sent to (normalised).
ISO instant after which neither the link nor the code redeems.
The name given with the request (sanitised, length-capped).
ISO instant the verification was requested.
SHA-256 (base64url) of the link token.
A verification that has been requested and not yet redeemed. Holds hashes only.