[TeMPOraL]

Or, they could use a hash of the password in the URL, that's always longer than what will fit in the visible part of the address box.