Images are stored encrypted on the server. The service worker decrypts them in your browser as they stream in. The password never leaves this page.
Demo password is demo-password (see README.md).
Try the wrong password to see decryption fail.