EncryptMaster — Stego Extract Image (LSB/AES-GCM)

Stego Extract Image is the recovery end of EncryptMaster's image-in-image feature. Stego Embed Image hid a compressed, encrypted secret inside a carrier; this node reads the carrier's least-significant bits, decrypts with your passphrase, and hands you back the hidden image. Feed it the cover PNG plus the right passphrase and out comes the secret - dimensions, encoding type, and all.

It exists so the "hide an image in an image" trick is actually usable as a workflow rather than a one-way curiosity. Embed on one machine, extract on another - or years later, from an archive - as long as the carrier survived untouched and you kept the passphrase.

How it works

Stego Embed Image wrote a 50-byte header (EMIIMG2 magic, the secret's height/width, encoding type, salt, nonce, payload length) followed by AES-GCM ciphertext into the cover's LSBs. This node reverses the whole chain:

1. Reads the LSBs and locates the EMIIMG2 header - trying 1 bit per channel, then 2, so it auto-detects the embedder's bit depth.
2. Extracts the full ciphertext, re-derives the key from your passphrase with scrypt, and authenticates + decrypts with GCM.
3. Decodes the recovered bytes - PNG or JPEG - back into an image at the secret's original dimensions.

Because the secret was compressed before encryption, what comes out is the compressed-then-decrypted bytes, decoded back to a full image. GCM authentication means a wrong passphrase or tampered carrier fails cleanly instead of producing corrupted noise.

Inputs and outputs that matter

• image (IMAGE) - the carrier. Must be the exact PNG/TIFF that came out of Stego Embed Image, untouched.
• passphrase (STRING, masked) - exact match to the embed passphrase.
• associated_data (STRING, optional) - the authenticated tag you set at embed time, if any.

Outputs are image (the recovered secret) and a report (STRING) that confirms the recovered dimensions and encoding - or explains the failure. Like the rest of the pack, failures are returned as a [StegoImage ERROR] ... report plus a 1×1 black image, not a thrown exception, so read the report rather than judging by the preview.

Installing it

Part of the ComfyUI EncryptMaster pack. Try ComfyUI Manager (search "ComfyUI EncryptMaster"), or clone:

cd ComfyUI/custom_nodes
git clone https://github.com/orion4d/Comfyui_EncryptMaster

Then the real dependencies (the repo has no requirements.txt; this is what actually installs):

pip install cryptography pillow numpy

Restart ComfyUI. No models, no GPU.

Where people get burned

• A black 1×1 image with a [StegoImage ERROR] report is the pack's way of failing loudly - not a tiny secret. The two most common causes: wrong passphrase or associated_data (GCM authentication fails), or the carrier was re-encoded as JPEG / recompressed by a platform (the header magic is gone). In the second case the secret is unrecoverable, period.
• Use the exact saved file. Cropping, resizing, or even re-saving the carrier through a lossy codec deletes payload bits. The chain is: Embed → save PNG → extract from that file.
• The recovered image reflects the embed settings. If the secret was resized to the cover at embed time, that's the size you get back; if it was JPEG-encoded at q85, the recovery is q85 quality. The report tells you which encoding was used, so a slightly soft recovered image isn't a bug - it's the JPEG you chose at embed time.

It's the counterpart to Stego Embed Image in exactly the same way Stego Extract Text pairs with Stego Embed Text - same header-driven auto-detection, same passphrase/AAD rules. Keep the passphrase somewhere you won't lose it; this is the only key to the vault.