The "nuclear codes" are an authentication protocol — they are a way to say, "I am someone who has permission to use nukes." They require there to be "locks" or "checks" of some sort in place to prevent unauthorized access or use of nuclear weapons.

There is no published description of how often these codes are changed or how they are selected.

The concept emerged out of concerns in the 1960s that pretty much all of the thousands of nuclear weapons in the US nuclear forces, both domestically and overseas, were basically able to be used by whomever had physical access to the weapons. The idea of some unauthorized person deciding to start nuclear war (made famous by Dr. Strangelove, but worried about before then), or that nuclear weapons stored in overseas bases (e.g. Turkey) could be basically "acquired" by non-Americans, made Kennedy administration officials very uncomfortable. They mandated locks on all overseas weapons (initially quite simple combination locks, later sophisticated electro-mechanical systems that would disable the bomb if you put the wrong code in too many times) and eventually all domestic forces.

There are many details, and much lore, about these codes but little declassified. Again, the codes themselves don't do anything but "unlock" the weapons for use, by proving that whomever gives them is authorized to have access to them. They don't specify targets or anything like that. They are the equivalent of a password. Ultimately they come back to the question of authorization — who has the power to decide to use nuclear weapons? — which has a somewhat complex history in the USA. (On the history of nuclear authorization in the USA.).