The key is held server-side in a sealed cookie — it never reaches your browser.