diff --git a/src/components/RequireSession.jsx b/src/components/RequireSession.jsx
index 9ed57fb..348efd7 100644
--- a/src/components/RequireSession.jsx
+++ b/src/components/RequireSession.jsx
@@ -6,11 +6,11 @@ import useSession from '../hooks/useSession.js';
  * After a logout it only opens the login page, so the next login does not land on the page of the last user.
  */
 export default function RequireSession() {
-    const {pathname, search} = useLocation();
+    const {pathname, search, hash} = useLocation();
     const {active, endReason} = useSession();
 
     if (active) return <Outlet/>;
-    const from = pathname + search;
+    const from = pathname + search + hash;
     if (endReason === 'logout') return <Navigate to="/login" replace/>;
     return <Navigate to="/login" replace state={endReason === 'expired' ? {sessionExpired: true, from} : {from}}/>;
 }
diff --git a/src/components/RequireSession.test.jsx b/src/components/RequireSession.test.jsx
index c442df4..e091d1f 100644
--- a/src/components/RequireSession.test.jsx
+++ b/src/components/RequireSession.test.jsx
@@ -30,6 +30,14 @@ describe('RequireSession', () => {
         expect(at(router)).toEqual({path: '/login', state: {from: '/library?status=PLAYING'}});
     });
 
+    // The bookmarklet sends its list in #data; it must survive the login.
+    it('keeps the hash of the deep link', async () => {
+        const router = renderAt('/library#data=abc');
+
+        expect(await screen.findByText('login')).toBeTruthy();
+        expect(at(router)).toEqual({path: '/login', state: {from: '/library#data=abc'}});
+    });
+
     it('shows the page with a session', () => {
         markSession();
         renderAt('/library');