The decryption key is included in the URL hash fragment (`#key=...`) and is never sent to any server.