Pixel Cipher
Lock an image behind a password
Images
Encrypt mode
Waiting for an image and password
Upload an image to start
How to use
Upload any image
PNG, JPEG, and WebP work. Encryption always exports as PNG to carry metadata.
Set a strong password
The tool derives an AES-GCM key (KEK) from your password and wraps a random 256-bit AES-CTR data key.
Let the pixels process
RGB channels are XOR-masked with a keystream. Transparent pixels are skipped to preserve outlines.
Download the encrypted PNG
Salt, IVs, wrapped key, and original MIME are saved into a tEXt chunk alongside the pixels.
Test decryption once
Reopen the saved PNG, enter the password, and verify the preview restores before sending it out.
Scope of the result
One image file at a time, up to 50 MiB, and only MIME types beginning with image/. Encryption always outputs PNG, because the salt and IV ride in a tEXt chunk. Decryption restores the original format only for JPEG and WebP; anything else comes back as PNG. Any re-encoding or edit that drops the PNG tEXt chunk makes the file undecryptable, and there is no password recovery.
Frequently asked questions
- Do images leave my browser?
- No. All encryption and decryption run locally via the Web Crypto API. Files are never uploaded or tracked.
- What formats are supported?
- Any format your browser can open for preview. Encrypted exports are always PNG; decrypting restores using the stored original MIME when possible.
- What happens to transparency?
- Transparent pixels are skipped during masking so silhouettes remain. During encryption, the alpha channel is set to 255 to avoid RGB corruption when saving.
- How is the key derived?
- PBKDF2 with 100,000 iterations creates the KEK from your password. A random AES-CTR key is wrapped by AES-GCM with its IVs and salt stored in the PNG.