Hacker News Reader

Since the encryption key is in the URL I don't think it's fair for them to claim they can't decrypt.

It is in the hash/fragment of the URL, that part is client side only and is never sent to the server.