They probably just create the key and then encrypt it with the pass code, as people usually do in these cases.