diff --git a/www/common/sframe-common-outer.js b/www/common/sframe-common-outer.js
index 538fb4019..039bca5e7 100644
--- a/www/common/sframe-common-outer.js
+++ b/www/common/sframe-common-outer.js
@@ -144,7 +144,7 @@ define([
                 });
             }));
         }).nThen(function (waitFor) {
-            if (!Utils.Hash.isValidHref(currentPad.href)) {
+            if (!Utils.Hash.isValidHref(window.location.href)) {
                 waitFor.abort();
                 return void sframeChan.event('EV_LOADING_ERROR', 'INVALID_HASH');
             }
diff --git a/www/drive/main.js b/www/drive/main.js
index bd2e506d4..0a7f78049 100644
--- a/www/drive/main.js
+++ b/www/drive/main.js
@@ -9,6 +9,7 @@ define([
     var requireConfig = RequireConfig();
 
     // Loaded in load #2
+    var hash, href;
     nThen(function (waitFor) {
         DomReady.onReady(waitFor());
     }).nThen(function (waitFor) {
@@ -19,6 +20,14 @@ define([
         };
         window.rc = requireConfig;
         window.apiconf = ApiConfig;
+
+        // Hidden hash
+        hash = window.location.hash;
+        href = window.location.href;
+        if (window.history && window.history.replaceState) {
+            window.history.replaceState({}, window.document.title, '#');
+        }
+
         document.getElementById('sbox-iframe').setAttribute('src',
             ApiConfig.httpSafeOrigin + '/drive/inner.html?' + requireConfig.urlArgs +
                 '#' + encodeURIComponent(JSON.stringify(req)));
@@ -37,19 +46,19 @@ define([
         window.addEventListener('message', onMsg);
     }).nThen(function (/*waitFor*/) {
         var afterSecrets = function (Cryptpad, Utils, secret, cb) {
-            var hash = window.location.hash.slice(1);
-            if (hash && Utils.LocalStore.isLoggedIn()) {
+            var _hash = hash.slice(1);
+            if (_hash && Utils.LocalStore.isLoggedIn()) {
                 // Add a shared folder!
                 Cryptpad.addSharedFolder(null, secret, function (id) {
                     window.CryptPad_newSharedFolder = id;
                     cb();
                 });
                 return;
-            } else if (hash) {
+            } else if (_hash) {
                 var id = Utils.Util.createRandomInteger();
                 window.CryptPad_newSharedFolder = id;
                 var data = {
-                    href: Utils.Hash.getRelativeHref(window.location.href),
+                    href: Utils.Hash.getRelativeHref(href),
                     password: secret.password
                 };
                 return void Cryptpad.loadSharedFolder(id, data, cb);
@@ -84,12 +93,15 @@ define([
             });
             sframeChan.on('EV_DRIVE_SET_HASH', function (hash) {
                 // Update the hash in the address bar
+                // XXX Hidden hash: don't put the shared folder href in the address bar
+                /*
                 if (!Utils.LocalStore.isLoggedIn()) { return; }
                 var ohc = window.onhashchange;
                 window.onhashchange = function () {};
                 window.location.hash = hash || '';
                 window.onhashchange = ohc;
                 ohc({reset:true});
+                */
             });
             Cryptpad.onNetworkDisconnect.reg(function () {
                 sframeChan.event('EV_NETWORK_DISCONNECT');
@@ -109,9 +121,11 @@ define([
         };
         var addData = function (meta) {
             if (!window.CryptPad_newSharedFolder) { return; }
-            meta.anonSFHref = window.location.href;
+            meta.anonSFHref = href;
         };
         SFCommonO.start({
+            hash: hash,
+            href: href,
             afterSecrets: afterSecrets,
             noHash: true,
             noRealtime: true,
diff --git a/www/teams/main.js b/www/teams/main.js
index 559e90c7c..36c4e4f66 100644
--- a/www/teams/main.js
+++ b/www/teams/main.js
@@ -9,6 +9,7 @@ define([
     var requireConfig = RequireConfig();
 
     // Loaded in load #2
+    var hash, href;
     nThen(function (waitFor) {
         DomReady.onReady(waitFor());
     }).nThen(function (waitFor) {
@@ -19,6 +20,14 @@ define([
         };
         window.rc = requireConfig;
         window.apiconf = ApiConfig;
+
+        // Hidden hash
+        hash = window.location.hash;
+        href = window.location.href;
+        if (window.history && window.history.replaceState) {
+            window.history.replaceState({}, window.document.title, '#');
+        }
+
         document.getElementById('sbox-iframe').setAttribute('src',
             ApiConfig.httpSafeOrigin + '/teams/inner.html?' + requireConfig.urlArgs +
                 '#' + encodeURIComponent(JSON.stringify(req)));
@@ -37,7 +46,6 @@ define([
         window.addEventListener('message', onMsg);
     }).nThen(function (/*waitFor*/) {
         var teamId;
-        var hash = window.location.hash.slice(1);
         var addRpc = function (sframeChan, Cryptpad) {
             sframeChan.on('Q_SET_TEAM', function (data, cb) {
                 teamId = data;
@@ -95,7 +103,7 @@ define([
         };
         var addData = function (meta) {
             if (!hash) { return; }
-            meta.teamInviteHash = hash;
+            meta.teamInviteHash = hash.slice(1);
         };
         SFCommonO.start({
             getSecrets: getSecrets,