ZML_图片转HTML

ZML_ImageToHTML (ZML_图片转HTML) turns an image - or an animation - into a single HTML file. Open the file and the picture renders in your browser. Look at it from the outside, in a file manager or an email attachment, and it looks like an innocuous web page. The author's own release notes are refreshingly direct about the use case: "from the outside you can't tell what's in this file at all, you have to download and open it locally… and as for when you'd actually use this… you know." Yeah. We know.

It's from ComfyUI-ZML-Image, zml-w's 160+ node pack, and it lives in the plain image subcategory.

How it works

The node takes your image (or GIF frames), base64-encodes the pixel data, and bakes it into a self-contained HTML file with inline JavaScript that decodes and renders it. One file, no external assets, opens in any browser - which is exactly why it looks like "just an HTML page" to anything that inspects file types. A GIF input gets exported as an animated page at the frame rate you choose via GIF帧率 (1–60 fps, default 16), so animations survive the trip as an actual moving image.

The knobs that matter:

• 文件名 and 保存路径 - where the HTML lands. Paths are relative to the ComfyUI root unless absolute; leave it empty for the default output folder.
• 标题 - the <title> of the page (max ~30 chars), which is what shows in a browser tab. It's also the plausible-deniability field: a title like "readme" makes the file look even more boring.
• 纯图片输出 (pure image output) - when enabled, the HTML contains only the image with no extra decoration. The default "disabled" adds some framing.
• 附加图像 + 附加图像分辨率 - attach a second image as a small thumbnail (100×100 to 500×500). Handy if you want a preview peephole on the page.
• The Help output is a STRING that tells you where the file was written.

The honest take

This is obfuscation-in-plain-sight, not real security. The pixels are base64 in a plain text file - anyone who opens the HTML in a text editor can decode it with a minute of work. What it's genuinely good for: moving an image through channels that block or flag image files, keeping a private library of images that looks like a folder of web pages, and sharing a picture through a link where you don't want the thumbnail preview revealing it before someone clicks. It will not survive a determined investigator, and it shouldn't be your tool for anything legally or professionally sensitive.

And note the metadata irony, given the pack's whole origin story: ComfyUI images normally carry their generation workflow embedded in the PNG. This node doesn't, because it's not writing a PNG - the HTML file contains just the pixels. That's a feature here, actually: your prompts and seeds don't travel with the disguised file.

Installing it

Pack install, same as all siblings:

cd ComfyUI/custom_nodes
git clone https://github.com/zml-w/ComfyUI-ZML-Image

restart ComfyUI, or ComfyUI Manager → search "ComfyUI-ZML-Image". No models, no extra dependencies beyond the pack's shared requirements.

Where people get caught

Keep the file. There's no node-side "decode an HTML back to PNG" - this is one-way, so if you overwrite or delete the HTML, you're out of luck (and out of the original if you didn't keep it). And remember the disguise only works on the outside: the moment the browser renders it, it's an image like any other. Export, share, don't expect it to be un-shareable.