EncryptMaster — Image Decipher ← Noise (AES-GCM)

This node is the "undo" button for the Image Cipher → Noise node. Feed it a PNG that looks like pure random static and it hands you back the original image - but only if you know the passphrase, and only if the file survived in one piece. It's the decryption half of EncryptMaster's "encrypt every pixel" pair, and without it the noise image is just noise.

Why would you want this? The use case is simple: you have an image whose contents you'd rather not have anyone recognize at a glance. Encrypting an image into static is stronger than the usual tricks - unlike just renaming a file or hiding a prompt in PNG metadata, an EncryptMaster noise image genuinely reveals nothing about what's underneath until someone decrypts it. It's also just a neat way to pass an image through a channel that "doesn't contain" the image.

How it works

When Image Cipher → Noise encrypts your image, it reads every pixel as raw bytes, encrypts them with AES-256-GCM, then stuffs the ciphertext plus a small header into a random-noise buffer. That header is 28 bytes: the magic bytes EMIMG1, your original dimensions, and the cipher length. This node reverses all of it:

1. Reads the raw bytes out of the noise image.
2. Finds and parses the EMIMG1 header to learn the original width, height, and payload size.
3. Derives the AES key from your passphrase with scrypt (N=2^14, r=8, p=1) plus the stored random salt.
4. Authenticates and decrypts, then rebuilds the original image at its original dimensions.

Because AES-GCM is an authenticated cipher, a wrong passphrase, tampered bytes, or mismatched associated data doesn't produce garbage - it fails cleanly.

Inputs and outputs that matter

• image (IMAGE) - the noise image you encrypted earlier. Save it as PNG or TIFF.
• passphrase (STRING) - must match the one used at cipher time, character for character. No recovery if you lose it.
• associated_data (STRING, optional) - this is authenticated but not encrypted. It must match what you set on the cipher node or decryption fails. Use it like a version tag (e.g. project=EncryptMaster;v=1) and reuse it consistently.

Outputs are image (the recovered original) and a report (STRING) that confirms the recovered dimensions or tells you what went wrong. Decipher errors are returned as a [ImageCipher ERROR] ... string plus a 1×1 black image - check the report, not just the preview.

Installing it

This is one node in the ComfyUI EncryptMaster pack, so installing the pack gives you all nine. In ComfyUI Manager, search for "ComfyUI EncryptMaster"; if Manager can't find it, the clone route always works:

cd ComfyUI/custom_nodes
git clone https://github.com/orion4d/Comfyui_EncryptMaster

Then activate your ComfyUI venv and install the real dependencies (there's no requirements.txt in the repo - the README's list is what actually installs):

pip install cryptography pillow numpy

Restart ComfyUI and the nodes show up under "EncryptMaster". No model downloads, nothing GPU-heavy. Tested on Python 3.10–3.12 with ComfyUI ≥ 0.3.x.

Where people get burned

• Save as PNG or TIFF. Always. The noise image's bytes are the ciphertext. A single JPEG re-encode scrambles bytes and the decrypt fails with a header or authentication error. This is the #1 failure mode, and it's also why you should never post these to platforms that re-encode images.
• Wrong passphrase or associated_data → clean GCM authentication failure. That's the node working as designed, not a bug.
• The noise image can be taller than the original. The cipher node grows the height to fit the crypto overhead when preserve_width is on. Nothing's wrong; the decrypt node just needs the whole thing.

The name is honest - this node decrypts. If all you wanted was to hide a short message instead of a whole image, the Stego Embed/Extract Text pair is the lighter-weight sibling for that job.