EncryptMaster — Stego Embed Text (AES-GCM)

Stego Embed Text is the pack's marquee move: take an ordinary image, encrypt a text message with AES-256-GCM, and bury it in the image's least-significant bits. The output looks pixel-identical to the input - same photo, same art, same colors - but it now carries a hidden, encrypted message that only Stego Extract Text and your passphrase can pull out.

Think of it as invisible ink that's also locked. ComfyUI already has a habit of baking workflow JSON into PNG metadata, which is great for sharing but means anyone can read your prompt out of a saved file. This is the opposite approach: the message lives in the pixel values themselves, not the file metadata, and it's encrypted on top of that. Hide a prompt, a password, a note, a key - in a carrier image that looks completely innocent.

How it works

The text is encrypted with AES-256-GCM (key derived from your passphrase via scrypt, N=2^14, r=8, p=1), producing a ciphertext plus a fresh salt and nonce. That gets packed into a 40-byte header - magic bytes EMSTEG1, bit depth, salt, nonce, payload length - followed by the ciphertext. Everything is flattened to bits and written over the lowest bit (or two) of each RGB channel of the carrier:

• bits_per_channel = 1: one bit per channel per pixel. Subtler, half the capacity.
• bits_per_channel = 2: two bits per channel. Double the room, slightly more visible texture in smooth areas.

Extract Text reads the header back out (it tries 1 bpc, then 2, so it auto-detects), pulls the ciphertext, and decrypts.

Inputs and outputs that matter

• image (IMAGE) - the carrier. Save the output as PNG/TIFF.
• text (STRING, multiline) - the message. Encrypted before embedding.
• passphrase (STRING, masked) - required, exact match at extraction.
• bits_per_channel - 1 or 2, as above.
• associated_data (STRING, optional) - authenticated metadata; it must match at extraction time or decryption fails. Use a stable tag and reuse it.

Output is a single image - the carrier with the message inside.

Installing it

Part of the ComfyUI EncryptMaster pack; install once, get all nine nodes. Try ComfyUI Manager (search "ComfyUI EncryptMaster"), or:

cd ComfyUI/custom_nodes
git clone https://github.com/orion4d/Comfyui_EncryptMaster

Then the real dependencies (no requirements.txt in the repo - this is the list that installs):

pip install cryptography pillow numpy

Restart ComfyUI. No models, no GPU.

The trap nobody warns you about

If your message is too big for the image, this node silently returns the original image unchanged. No error string, no red flag - just a carrier with nothing in it. It's the single most confusing behavior in the pack, and it's exactly why the Stego Capacity Estimator exists: run it first, confirm your text fits at your chosen bit depth, then embed. At 1 bpc a 1024×1024 image holds roughly 390 KB of payload - plenty for any realistic note - but "plenty" is not "infinite."

Beyond that, the usual EncryptMaster rules apply with extra force: save the result as PNG or TIFF (JPEG re-encoding destroys the LSBs), and don't post the carrier to platforms that recompress images. The classic pipeline is Text Cipher (encrypt) → Stego Embed Text → save PNG, which gives you defense in depth: even someone who extracts the payload can't read it without the passphrase.