paloma // steganographic transport

paloma

steganographic transport // aes-256-gcm

[01] pipeline mode

lsb // carrier

Embed in least significant bits of a real image. Visually unchanged.

noise // standalone

Generate a new PNG from data. No carrier required.

[02] payload input

direct text / source

drop file(s) — multiple ok

□

drop file(s) or click

any type // .zip ok // drag more to append

[03] carrier images

▦

drop png — single or multiple

drag more anytime // click × to remove

payload: 0 B capacity: 0 B

[04] split strategy

mode

max payload / png

auto: keeps a single png while capacity allows. splits on demand.

[ok] output

[05] cipher aes-256-gcm // pbkdf2-sha256 200k

len style

none

scatter embed // pseudo-random bit distribution (harder to detect)

note: canvas re-encoding strips exif/gps metadata from carriers automatically.

[01] drop images

▦

drop png(s) — paloma, noise or qr image

drag more to append // click × to remove

or paste qr payload / encrypted string

camera scanner

sound

scan session

[ok] extracted

message / text

attached files

[02] passphrase

none

[01] qr profile

Paloma-Nativ

High-density QR (ECC-L), deflate, multi-chunk up to 200 codes. ~2 KB/code. Requires paloma to decode.

Kompatibel

Conservative QR (ECC-M). Single code, ~1 KB max. Plain mode readable by any scanner.

nativ: up to 200 qr codes, confirmation at 50+

[02] qr mode

plain

Text straight into qr. No encryption. Any qr scanner reads it.

encrypted

AES-256-GCM then qr. Recipient pastes into paloma to decrypt.

[03] payload

text

file(s)

□

drop file(s) or click

any type // drag more to append

payload: 0 B limit: 0 B

[04] cipher

len style

none

[ok] output

size 256px

1 / 1

batch 1 / 1

copy-string (one line per qr)

[i] transport modes

lsb png: embeds payload into the least significant bits of a carrier image. Visually indistinguishable. Best stealth. Capacity ~3 bits per pixel.

noise png: pixel values are the payload itself. Looks like colored noise. No carrier needed, maximum capacity.

qr code: for small texts. Plain mode is scannable by any app. Encrypted mode requires paloma on the recipient side to decrypt.

[i] cipher

aes-256-gcm with pbkdf2-sha256 (200k rounds) key derivation. Authenticated — wrong pass fails cleanly.

scatter embed: payload bits written to pseudo-randomly permuted pixel positions derived from the passphrase. Defeats naive steganalysis.

[i] multi-file payload

Mix text and multiple files in a single payload. On decode, text shows in the text area and files appear as a list for individual download, bulk save or zip.

[i] multi-part splitting

auto: single png while one fits, otherwise split across available carriers.

manual: fixed max chunk size, for strict mail limits.

reassembly: drop all parts together in any order. Archive id matches chunks, sha-256 verifies integrity.

[!] transport caveats

Send png as attachment, never inline. Some clients recompress inline images and break the payload.

Gmail passes png attachments through unchanged. For large splits, use multiple mails — order of arrival is irrelevant.

Never jpeg. Lossy compression destroys the payload. Output is always png.

[!] security scope

Designed for convenience against content filters — not a replacement for gpg/age/signal. Symmetric passphrase only. No forward secrecy. Scatter-lsb hides well from casual detection but is not designed to resist dedicated modern steganalysis.

The "burn" button clears in-memory state and localStorage, then reloads. It is not a forensic wipe — ram, swap, browser caches and disk paging are beyond js control.