SecretTransport
Turn any text into an image you can paste into a message or email. Only someone with the passphrase can turn it back. Everything happens in your browser: nothing is uploaded.
Using Outlook? Download the Outlook add-in manifest ·
Send to a public key instead (none)
Lock this to one or more people's public keys. Nobody has to share a passphrase: only the owner of a matching private key can open it. You can still add a passphrase above as a second way in. Works with every image style except fake QR codes; for photos the hidden position comes from the recipient's public key, so it hides the message less secretly than a passphrase would.
More messages in this photo (optional)
Hide up to 4 messages in one photo, each with its own passphrase (and optional pass code). Whoever has a passphrase or pass code sees only that message and cannot tell the others exist. Each message gets a share of the photo's room, so a bigger cover photo holds more. Not combined with splitting. The animation, reading time and expiry settings apply to every message.
More options (defaults)
The animation, reading time and expiry are stored inside the encrypted image. Expiry is a courtesy enforced by this app, not a lock. A pass code is a second way in (the image key is stored in the image, locked by it), so the image is only as strong as the weaker of the passphrase and the pass code. Hover over a setting for details.
Paste an image here (Ctrl/Cmd+V), drop files, or . A split secret needs all its images.
How it works, when to use it, and which apps keep the image
How it works
- Encrypt. Your browser encrypts the secret (text, a file or a pasted picture) with your passphrase: AES-256-GCM, with a key from Argon2id, which is deliberately slow and memory-hungry so that guessing is expensive. Your choices (reveal animation, reading time, expiry) are sealed inside the same encrypted data. An optional recipient pass code is a second way in.
- Hide. The encrypted bytes, with error correction added, are drawn into an image: a code-art mosaic, a QR code (a phone camera opens this page with the secret ready for the passphrase), a fake QR code (it scans as a harmless decoy while the real data hides in the error-correction budget) or an ordinary-looking photo. One photo can hold up to 4 messages, each with its own passphrase and pass code, and a secret that is too big is split across several images.
- Send. You send the image like any picture: pasted, attached or scanned.
- Reveal. The recipient pastes, drops, picks or scans the image on the Reveal tab and types the passphrase (or pass code). The original comes back with an animation, and clears itself from the screen after the reading time. Nothing is uploaded: there is no server.
How to use
Sending
- On Hide a secret, type or paste your text (or choose a file, paste a picture, or read the text from a camera photo) and enter a passphrase, or press Generate.
- Pick an Image style: code art (works almost everywhere), QR code (opens this site when scanned), fake QR code (scans as a decoy) or hidden in a photo (looks like an ordinary picture; the JPEG-safe method survives normal recompression). You can choose your own cover photo.
- Optionally open More options: a reveal animation (one of 80), a reading time, an expiry from 1 minute to 30 days, and a recipient pass code. With the photo style you can also add up to 3 more messages to the same photo, each with its own passphrase. Or open Send to a public key instead to lock it to someone's public key, so no passphrase has to be shared (they make a key once under My keys and contacts and send you the public half).
- Press Create image, then Copy message (the image, a link to this site and, for code art and QR, a direct link to the secret) and paste it into an email or chat, or download the image. Give the passphrase to your recipient by a different route.
Receiving
- Open the link, use the Reveal secret button of the Outlook add-in, or use this page's Reveal a secret tab: paste (Ctrl+V), drop or choose the image, or scan a QR code with the camera. If the secret was split, add every part.
- Type the passphrase (or the pass code) and press Reveal. If the secret was sent to your public key, the box changes to Your key's passphrase: type the passphrase you chose when you made your key (not a shared secret). Your key has to be saved on this device, or restored first from its backup under My keys and contacts. Watch the animation (or press Skip), read the secret, copy it or save the file. It clears itself after the reading time.
When to use this
- Good for: sending a password, API key, recovery phrase or private note over a channel you do not fully trust (email, chat), when you can give the passphrase by a different route (a phone call, in person). Also for hiding text in plain sight inside a photo.
- Not for: anything that must stay safe against someone who gets the image and can guess the passphrase. They can try guesses offline for as long as they like, so use a long random passphrase (the Generate button makes one).
- Not for: long-term storage or anything you cannot afford to lose: there is no recovery if the passphrase is forgotten. It is also no replacement for an end-to-end encrypted messenger or a password manager, and an expiry is a courtesy rather than a lock.
Which apps keep the image intact
What matters is whether an app delivers your image as it is or re-compresses and shrinks it like a photo.
| How the image travels | Code art, QR, fake QR | Photo, JPEG-safe | Photo, lossless |
|---|---|---|---|
| Sent as a file: email attachment, "send as file" or "document" in chat apps, cloud-drive link | Yes | Yes | Yes |
| Re-compressed as JPEG at the same size | Yes (tested down to JPEG quality 50) | Yes (tested down to quality 50) | No |
| Shrunk, as many chat apps do to photos | Code art: yes (tested at 60% size plus JPEG). QR and fake QR: usually, while still big enough to scan | No | No |
| Screenshot of the whole image | Yes | Usually, if it is not scaled | Only if exact pixels |
| Cropped, rotated or only part of it | No | No | No |
In practice: attachments and "send as file/document" options (email, Telegram, WhatsApp, Signal) generally deliver the original. Sending as a normal photo in most chat and social apps (WhatsApp, iMessage, Messenger, Instagram, and Telegram or Signal photo mode) re-compresses it and may shrink it, so use Code art or a JPEG-safe photo there. Pasting inline into an email usually works but some mail programs resize large pictures. Apps differ and change their behaviour between versions, and not every app has been tested: send yourself a test image first.
My keys and contacts (public-key encryption)
With a passphrase, you have to get the passphrase to your recipient safely. With public keys you don't: the person you want to hear from makes a key once, shares the public half freely, and keeps the private half on their device, locked by a passphrase. Anyone can then lock a secret to that public key, and only that person can open it. Everything happens in your browser, and the private key never leaves this device.
Make a key
Back the key up. If this browser's data is cleared or you switch device, anything sent to the key is lost for good unless you have the backup file and its passphrase. The passphrase is also asked for whenever you open a message sent to your key.
Restore a key from a backup
Contacts
Use it inside Outlook (add-in)
An email program cannot run the decryption itself, so SecretTransport has an Outlook add-in: a Reveal secret button that opens a pane beside the email, picks up its image attachment (or secret link) and asks for the passphrase. Everything runs on your device.
Add-in manifest link:
- In Outlook choose Get Add-ins (or Manage add-ins), then My add-ins, then Add a custom add-in, then Add from URL.
- Paste the manifest link above and confirm. If your Outlook does not accept a link, press Download file instead and choose Add from file (browse to the downloaded
manifest.xml). - Open an email that holds a secret image or link and click Reveal secret on its toolbar. Type the passphrase in the pane. Click the pin icon at the top of the pane to keep it open: it then follows you from email to email.
A Microsoft 365 admin can add the same manifest under Integrated apps for a whole team. The pane loads Microsoft's office.js (Outlook needs it); this page loads nothing from third parties. The add-in has been tested with a stand-in for Outlook, not yet inside every real Outlook, and some organisations block custom add-ins.