embed an AES-256 encrypted message into the least-significant bits of a PNG. invisible to the eye, undetectable in the file list, decodable only here with your passphrase. 100% in-browser — the image never leaves this machine.