You might consider using a hash instead of a query string, since hashes are not sent to the server (and thus will not be logged). For example here in the client-side decryption here: https://observablehq.com/@mbostock/encrypted-message

I opened a feedback issue about this here: https://github.com/observablehq/feedback/issues/350

switched to using hash instead of query string & linked to issue