// open

The key was in the link. It stays in this tab.

The page locates the bucket read route, then a Service Worker fetches ciphertext in ranges and decrypts on the fly — playback and download both stream, so even huge files stay light.