RSA Encrypt Image

This node is the whole reason the pack exists: you feed it an image and someone's RSA public key, and it writes out a file only that key's owner can open. It's not a watermark and it's not obfuscation - it's real asymmetric encryption sitting in a node graph. If you need to hand a finished render to a client or collaborator over a public channel without anyone else being able to look at it, that's the use case.

Let's be straight about the audience, though: the node has essentially zero community footprint, and there isn't a workflow on earth that needs RSA-encrypted PNGs. This is a niche tool, a small proof-of-concept pack, and maybe the only "Encryption" category entry in your node list. Fine. It's also a clean, real example of how hybrid crypto works, which makes it genuinely fun to poke at.

How it works (the name is a white lie)

RSA alone can't encrypt your image. A 2048-bit key with OAEP padding can only handle about 245 bytes per operation, and a PNG is far bigger. So the pack does what real systems like PGP and TLS do: hybrid encryption. It generates a random 256-bit AES key, encrypts your image data with AES-256-CBC, then encrypts that AES key with your RSA public key. The output file is laid out as RSA-encrypted AES key + IV + AES-CBC ciphertext.

So "RSA Encrypt Image" is a bit of a misnomer - the bulk crypto is AES, and RSA just wraps the session key. That's exactly how it should be done, so don't read it as a cheat. Before encrypting, your image gets converted from a ComfyUI tensor to a PIL image and re-encoded as PNG, so transparency survives the round trip.

The inputs and output that matter

• image (required): any IMAGE from a LoadImage node or a VAE-decode output. It takes the first frame if you feed it a batch.
• public_key_pem (required): the public key as a PEM string. Wire it straight from the pack's RSAKeyGeneratorNode, or paste a PEM into a string node. It has to be valid PEM or the cryptography library throws.
• out_path (optional): where to write the .rsa file. Leave it blank and you get encrypted_image_0.rsa in your working directory (it auto-increments so it never overwrites). It also understands %date:yyyy-MM-dd% style placeholders if you want timestamps in filenames.
• Output: file_path (STRING): the path of the file that was written. It's just text - view it, or wire it to a node that cares about paths.

The trap: there's no decrypt node

The pack only ships the encrypt side for ComfyUI. decrypt_image exists, but only as a Python library function in rsa_encrypt.py - there's no node for it. So inside the graph this is a one-way trip. To get the image back, you decrypt outside ComfyUI with the standalone script the README documents (open encrypted_image.rsa, load the private key, call decrypt_image). Plan for that before you encrypt something you actually need.

Installing it

cd ComfyUI/custom_nodes
git clone https://github.com/SilentZhang/comfyui-encrypt

then restart ComfyUI, or just search comfyui-encrypt in ComfyUI Manager. Either way the nodes appear under the Encryption category. The only dependency you don't already have is cryptography - Pillow and numpy ship with ComfyUI, and the pack's install.py runs pip for you on first load. No model files, nothing heavy. If public_key_pem gives you a ValueError on load, the usual culprit is a mangled key (extra whitespace, wrong line endings from copy-paste). And remember the relative-path quirk: a relative out_path is resolved against ComfyUI/output under your working directory, which can turn into ComfyUI/ComfyUI/output depending on where you launched from. Give it an absolute path and skip the scavenger hunt.