Key is in the hash. Check 0bin.net. We use the same trick to encrypt the pastebin content. The sources are available so you can see the gist of it. It's a very simple code.
But JavaScript encryption is not secure!
Here's the original discussion: https://news.ycombinator.com/item?id=2935220