Credentials stay on the server. You supply only the captcha and OTP.
Locked
Step 1 — Login
Step 2 — Captcha
Step 3 — OTP