To be accurate, they don’t know either. A login key and a decryption key are derived from password and secret key client-side.