Encryption key should be handled only by the browser

[neuhaus]

Right now, the server could be modified to save an unencrypted version of the password.

I'm suggesting to instead create the encryption key in the client, encrypt and decrypt in the client.

The encryption key would be transported in the fragment part of the URL following the hash sign that never gets sent to the server.

That's also how it's done in cryptpad.

[neuhaus]

I found another project that does it this way: https://privatebin.info/

[yurushao]

The encryption key would be transported in the fragment part of the URL following the hash sign that never gets sent to the server.

Yeah this is a good idea.