[RadioactiveMan]

Since the encryption key is in the URL I don't think it's fair for them to claim they can't decrypt.

[willdurand]

It is in the hash/fragment of the URL, that part is client side only and is never sent to the server.