C2C Vault — Locked (password to run)

ComfyUI's whole sharing culture runs on "workflow included" - every PNG you save carries the full node graph in its metadata, and that's usually the point. It stops being the point the moment you hand a paying client a finished pipeline and they can read your entire recipe, or you want to send something runnable without it being copy-pasteable into someone's own canvas. C2C Vault - Locked (from the big Code2Collapse/ComfyUI-CustomNodePacks suite) is the ecosystem answer to that second case: you fold a selection of nodes into one opaque node whose wiring travels as AES-GCM ciphertext, and it refuses to run until someone enters the password.

No API, no key, no cloud involved - this all happens on your machine. To get it, install the parent pack the usual way: ComfyUI Manager → search CustomNodePacks, or cd ComfyUI/custom_nodes && git clone https://github.com/Code2Collapse/ComfyUI-CustomNodePacks.git, then restart ComfyUI. It needs the cryptography package and a password you type once per session.

How it works

You start with the nodes you want to protect on the canvas. Select them, then right-click the canvas itself and pick C2C: Lock selection into a Vault (password to RUN). Set a password, and the server serializes those nodes into a little "subgraph" JSON - nodes, links, and the wires that cross the boundary - encrypts it with AES-256-GCM, and drops a fresh C2C_VaultLocked node into your graph where the selection sat. The originals stay on the canvas - delete them once you've verified the vault runs, or the plaintext graph sits right next to the vault you built to hide it.

Two design choices are worth understanding, because they're why this isn't theater. First, the password is never a widget value - a widget gets serialized into the very workflow JSON the vault exists to protect. It's POSTed to an HTTP route, stretched through PBKDF2-HMAC-SHA256 at 600,000 iterations, and only the derived key is kept in server memory for the session. Second, at run time the node decrypts the subgraph and executes it with its own tiny topological executor instead of ComfyUI's - ComfyUI's would emit per-node progress bars that name your internals. You see one output and no hint of what's inside.

That AES-GCM setup is tighter than it looks. The header - vault id, KDF parameters, and a hash of the vault's input/output sockets - is authenticated alongside the ciphertext, so a wrong password, a flipped byte, or a payload swapped into a different vault all fail identically.

The inputs that matter

• vault_id - a plaintext label for which unlocked session this node may use. Not secret; the UI fills it for you.
• vault_payload - the base64 ciphertext that rides along in the workflow. Never edit it by hand; the UI collapses it out of sight.
• input_0 / input_1 / input_2 - up to three wires can cross into a vault. Try to lock a selection that needs more and the UI refuses; select upstream nodes too.
• output - a single wildcard socket. If your selection produces several outputs, you get a warning and only the first is wired through.

Be honest about what this buys you

The author is refreshingly straight about the scope: it's a lock on a door, not a safe. The subgraph has to exist as plaintext in memory to run, so anyone who can execute Python in that process - attach a debugger, read memory, edit the pack - can recover it. What it genuinely stops: someone opening your saved PNG or .json and reading the wiring, pasting your nodes into their own workflow, and casual copying. That's most of what you'd actually fear when sharing a workflow. Nothing that must eventually execute what it protects can stop a determined attacker.

Common issues

• "Vault locked…" at queue time - you need to click the Unlock… button on the node and type the password first. The session lasts a working day by default (480 min); if it dies mid-render, set C2C_VAULT_TTL_MINUTES higher (0 = until ComfyUI restarts).
• Five wrong guesses earns a five-minute lockout - per vault, not per IP, because the attacker already has the file.
• Lost password means lost vault. No recovery path, by design. Store it.
• Recipient missing a node type inside the vault - after a successful unlock the error helpfully lists which packs to install. Before unlock it says nothing, on purpose.
• cryptography not installed - the node still loads (so workflows don't break), but locking and unlocking error with the pip hint. Install it into ComfyUI's Python: <ComfyUI python> -m pip install cryptography.

If the recipient should run it freely without ever typing a password - you just don't want them reading it - meet the sibling C2C Vault - Sealed node instead.