The key is encrypted in the local SQLite database with a passphrase stored in data/.secret. It never reaches the browser.