The message is stored inside the shared link using Base64URL encoding. That is not encryption — anyone with the complete link can decode and read it in normal mode. In static mode this website does not need to save or transmit your message to a server (the fragment stays in the browser). Optional encrypted mode uses the Web Crypto API (PBKDF2 + AES-GCM) and never puts your password in the URL.