They are using location.hash.

history.replaceState() wouldn't break the back button, but apparently history API is throttled in some browsers; see the "One Last Thing" section on https://matthewrayfield.com/articles/animating-urls-with-jav... .