Aha that is a great question! There are 2 parts of the key, one is the anchor tag key (the part behind # that you see in download url) and your password. The anchor tag key part is ALWAYS generated randomly in the browser so that your file will be encrypted no matter what even if you forget to enter password and hit upload.

Note that the anchor tag part does not leave the browser so it is one of the clever thing firefox send used to share some id/key. You can double check it in the network tab ;) If you are worry about that key being leaked somehow, adding a password ontop is a good measure.

The file is encrypted before upload. The decryption key is supplied in an anchor tag. This is the case even if there's no password.