Without JavaScript, notes can be shared only as an unencrypted plain-text link — readable by anyone with the link and by the server.
For encrypted notes the key after # never reaches the server — anyone with the full link can read the note until it expires. Read-only links are a snapshot; editable links stay live until expiry.
#