✧ Private Decrypt Load Image

PrivateDecryptLoadImage is the answer to a very specific problem: what if the image itself is the thing you don't want sitting on the server's disk in plaintext? It's the "✧ Private Decrypt Load Image" node from the ComfyUI-Spellcaster pack, and it replaces ComfyUI's normal LoadImage when the input arrives as an encrypted blob rather than a file. If you're just dragging images into ComfyUI for your own projects, this isn't for you. It's aimed at the pack's private add-on - the client-side workflow rewriter that swaps in this node when a Spellcaster client (the GIMP/Darktable plug-in) uploads a wire-encrypted image instead of a plain PNG.

How it works

The encrypted input comes in as a base64 string: a V1W envelope wrapping a PNG with ChaCha20-Poly1305 (AEAD). The node base64-decodes it, decrypts in memory, decodes the inner PNG, and hands you the image tensor - all in RAM. At no point does the plaintext hit the server's disk. That's the whole design goal, stated right in the source: "the plaintext NEVER touches disk on this server."

Decryption needs an auth token shared with the client, resolved in this order: ~/.spellcaster/auth_token on the server, then the SPELLCASTER_PRIVATE_AUTH_TOKEN env var, then a pack-local .auth_token file. The key is derived from the token via HKDF, so both sides agree without ever storing the key itself.

Inputs and outputs

One required input: encrypted_b64 - the base64-encoded V1W envelope, pasted in as a multiline string. (In practice you never type this; the client's workflow rewriter injects it.)

Two outputs, matching LoadImage's shape so it's a drop-in replacement:

• image - the decrypted IMAGE tensor.
• mask - a MASK; built from the image's alpha channel if the source was RGBA, otherwise all-ones.

Install

Same pack as the rest of Spellcaster, so install once and you get both private nodes:

cd ComfyUI/custom_nodes
git clone https://github.com/laboratoiresonore/ComfyUI-Spellcaster.git

or search "Spellcaster" in ComfyUI Manager, then restart.

Troubleshooting

This node fails loudly, which is at least honest. The errors you'll hit, in order of likelihood:

• "encrypted_b64 is empty" - the node got nothing; the client never wrapped the upload.
• "AEAD unwrap failed" - the server's auth token doesn't match the one the client used (or the envelope is corrupted). Check that the token made it to one of the three lookup locations - this is the classic failure and the error message points at the setup step for a reason.
• "PNG decode after decrypt failed" - decryption succeeded but the inner bytes aren't a valid image; usually a corrupt envelope.

The real friction here is auth-token setup, not the node itself. If you're not using the Spellcaster client ecosystem, you'll never legitimately have a V1W envelope to feed it - that's fine, ignore it and use LoadImage.