Decrypt XOR Pickle from File

Load XOR Pickle From File is the reading half of this pack's save/load pair. Its sibling Save XOR Pickle To File takes any object from your graph, pickles it, compresses it, and XOR-encrypts it to disk. This node reverses that: point it at the file, hand it the password, and you get the original Python object back on the object output - ready to wire straight into whatever node needs it.

This is the node that actually earns the pack a place in a workflow. Save a dict of settings, a list of prompts, a Lora stack config, anything that's a pain to retype - then load it on the next run like it never left. It's the ComfyUI-flavored version of a config file, except it can hold any object, not just text.

How it works

Four steps, in this exact order:

1. Read the file as raw bytes.
2. XOR-decrypt with the password-derived key (SHA-256 of the password, repeated to data length).
3. zlib.decompress - the save node compressed before encrypting, so this node decompresses after decrypting.
4. pickle.loads - reconstruct the Python object.

Everything is standard library: pickle, hashlib, zlib, os. No external dependencies, nothing to download.

Two things worth saying about the format. First, this only reads files produced by this pack (or something implementing the exact same zlib→XOR scheme) - it's not a plain pickle, and not any standard encryption format. Don't feed it an arbitrary .pkl. Second, the "encryption" is obfuscation-grade: single SHA-256 key derivation, no salt, no iterations. It'll stop a glance, not an adversary.

The bigger caveat is pickle itself. Unpickling executes code - pickle.loads on a file from an untrusted source is functionally running a program. The safetensors format exists precisely because of this danger, and the XOR wrapper does nothing to fix it: decrypting doesn't authenticate the file. If you don't know where a .pkl came from, do not load it, password or no password.

Inputs and outputs

• filename - the path to the encrypted .pkl. Defaults to file.pkl.
• password - exact match for the one used at save time.

One output, object (ANY), which plugs into anything accepting a generic object.

The path gotcha that will bite you

Save XOR Pickle To File writes into ComfyUI's output/ directory - it prepends folder_paths.get_output_directory() automatically. This load node does not. It opens filename as a raw path, relative to wherever ComfyUI was launched from. So a file you saved as secret.pkl (which landed in output/secret.pkl) will not load with filename set to secret.pkl.

Either give the full path:

/absolute/path/to/ComfyUI/output/secret.pkl

or the launch-directory-relative path:

output/secret.pkl

It's an asymmetry the README doesn't mention, and it's the number one "why won't it load" for this pack.

Installation

cd ComfyUI/custom_nodes
git clone https://github.com/iacoposk8/xor_pickle_nodes

Restart ComfyUI. Or search "xor_pickle_nodes" in ComfyUI Manager. Pure standard library, no dependencies.

Common issues

• "File non trovato" - that's the path issue above. Full path, or output/ prefix.
• zlib.error on load - almost always the wrong password. The decompress step fails loudly on garbage bytes, which is a handy side effect: you get a clear signal instead of silent corruption.
• Error about "unsupported pickle protocol" - the file wasn't made by this pack. Wrong file, not a bug.