Recipient must enter this passphrase to unlock. It's derived to a key in their browser and never sent to the server.