Question 1

What is hiddenPix?

Accepted Answer

hiddenPix is a browser-based image encryption tool with two modes. Scramble turns an image into unrecognizable pixel noise; Steganography hides a private image inside an ordinary-looking photo. All processing runs locally in your browser — your original images and password are never uploaded.

Question 2

What algorithms does hiddenPix use?

Accepted Answer

Scramble Mode derives a seed from your password, generates a pseudorandom Fisher-Yates permutation and shuffles the image's pixel blocks (4×4 up to 64×64) accordingly. Steganography Mode XOR-encrypts your secret file with your password and embeds the result in the least significant bits of the cover image's RGB channels (1 bit per channel). Honest caveat: this is lightweight visual protection — not AES-GCM or any audited cryptographic standard, and there is no integrity or authentication layer. If you need cryptographic guarantees, use a dedicated tool such as age, 7-Zip (AES-256) or VeraCrypt.

Question 3

Is the output really undetectable?

Accepted Answer

We make no such promise. Without the password the hidden content cannot be recovered, and visually the output looks like an ordinary image. But steganalysis tools can flag LSB-embedded images, and scrambling preserves statistical features such as the color histogram. Treat hiddenPix as everyday privacy protection against curious eyes — not as a defense against a determined attacker.

Question 4

Can I post the image on WeChat, Weibo, Instagram or other social platforms?

Accepted Answer

Be careful: most platforms re-compress images on upload. Re-encoding destroys LSB-embedded data — the hidden image becomes unrecoverable — and degrades scrambled images as well. Always send the encrypted PNG as a file or "original image" (a chat file attachment or a cloud drive link), and confirm the recipient can decrypt it before relying on it. The share link is the safest route because it serves exactly the file that was uploaded.

Question 5

"No server" — how does that square with share links?

Accepted Answer

Encryption and decryption always run locally in your browser; nothing is uploaded while processing. When you generate a share link, the already-encrypted file is temporarily uploaded to cloud object storage so the recipient can download it. It is automatically deleted after 24 hours. The server never receives your password, your original image or any unencrypted data, so nobody — including us — can decrypt the shared file. Transfer metadata such as access logs remains subject to the hosting provider's policies.

Question 6

How strong is the password protection?

Accepted Answer

It depends entirely on your password. The key is derived from your password with a simple hash — there is no key stretching — so short or common passwords can be guessed quickly. Use a long, random password and send it through a different channel than the image.

Question 7

What happens after 24 hours?

Accepted Answer

The share link stops working and the file is permanently deleted from the server. There is no backup and no recovery. Decrypt and save anything you want to keep before the link expires.

Question 8

When should I use something else?

Accepted Answer

Whenever you need provable security: legally sensitive material, anything a motivated adversary is actively after, or data with compliance requirements. Use audited encryption tools like age, GPG, 7-Zip or VeraCrypt for those. hiddenPix is designed for everyday privacy — keeping personal photos out of casual view.

Contact hiddenPix

What to Reach Out About

A Note on Privacy