It is in the hash/fragment of the URL, that part is client side only and is never sent to the server.