client-side · nothing leaves your device

hide a message
inside a picture.

the words get encrypted in your browser and tucked into the pixels of an ordinary image. the picture looks exactly the same. only someone with the password, and the hunch to look, gets them back out.

pick an image to see how much fits.

how it works

  1. encrypt. if you set a password, the message is sealed with AES-GCM, keyed off your passphrase, before anything else happens.
  2. embed. every bit of that ciphertext is written into the lowest bit of the image's colour channels. the shift is one step per channel, invisible to the eye.
  3. ship. you get a normal-looking png. send it however you send pictures. the words are not in the filename or the metadata, they are in the grain.
  4. reveal. the other side drops it here, types the password, and the same math runs backwards. no server ever sees the image or the message.