Following [0] a few days ago @atc1441 managed to reverse engineer the toothbrush firmware and find the algorithm for calculating the password found by [0].

[0]: https://news.ycombinator.com/item?id=36128617