EncryptMaster — Text Cipher (AES-GCM)

Text Cipher is the plain-vanilla encryption node at the center of the EncryptMaster pack: you give it a string and a passphrase, pick encrypt or decrypt, and it hands you back an encrypted "armored" string that only your passphrase can open. It's AES-256-GCM under the hood with scrypt key derivation - real cryptography, not the toy "encryption" you sometimes find in custom node packs.

Here's the thing that makes it worth having in a ComfyUI workflow: ComfyUI ships your workflow JSON - prompt, seed, sampler settings - inside the PNG metadata of every image you save. That's a feature for sharing, but it also means your prompt and settings are sitting right there in the file for anyone with a text editor. If you're working on something you don't want broadcast, encrypt the sensitive strings before they get saved, or before you drop them into a stego node. It's also handy for credentials and API keys you pass around a graph so they're not plaintext in every saved workflow.

How it works

Your passphrase plus a fresh random 16-byte salt go through scrypt (N=2^14, r=8, p=1) to derive a 256-bit AES key. The text is encrypted with AES-GCM using a random 12-byte nonce, and the whole thing is emitted as a single self-contained armored string:

aesgcm-scrypt.v1$<salt>$<nonce>$<ciphertext>

That string carries everything needed to decrypt except your passphrase - salt and nonce are embedded in it, so you only ever need to remember the passphrase. GCM is authenticated, so tampered ciphertext or a wrong passphrase fails cleanly instead of producing mangled output.

Inputs and outputs that matter

• text (STRING, multiline) - plaintext when encrypting, the armored string when decrypting.
• passphrase (STRING) - entered in a masked password field. Must match exactly at both ends.
• mode - encrypt or decrypt. The only thing that switches direction.
• associated_data (STRING, optional) - authenticated metadata. Not secret, but if it differs between encrypt and decrypt, decryption fails. Think of it as a version or context tag (project=EncryptMaster;v=1).

Output is a single text STRING: the armored ciphertext or the recovered plaintext. One gotcha - errors are returned as a string starting [TextCipher ERROR] ... rather than a thrown exception, so the node never "crashes" your graph; it just hands you an error string. Check your outputs.

Installing it

Text Cipher is one of nine nodes in the ComfyUI EncryptMaster pack. Install the pack once and you get them all. Try ComfyUI Manager first (search "ComfyUI EncryptMaster"), or clone it:

cd ComfyUI/custom_nodes
git clone https://github.com/orion4d/Comfyui_EncryptMaster

Then, in your ComfyUI venv, install the actual dependencies (there's no requirements.txt in the repo, so this is the list that matters):

pip install cryptography pillow numpy

Restart ComfyUI and you'll find it under "EncryptMaster". No models to download, no GPU requirement.

The natural workflow

The README's own suggested pipeline: Text Cipher (encrypt) → Stego Embed Text → Save Image (PNG). Encrypt the message so the hidden payload is unreadable even if someone extracts it, then bury it in the LSBs of an innocent image. To read it back, run Stego Extract Text and feed the result into Text Cipher in decrypt mode.

Two honest warnings. First, AES-GCM is only as strong as your passphrase - a human picking "password123" gets scrypt-slowed but still guessed. Use the pack's Generate Passphrase node. Second, the armored output is a bit long; that's the price of self-contained encryption, and it's fine for the "hide text in images" use case this pack targets.