Not just encrypted
Your data is encrypted and also concealed inside an ordinary-looking image (PNG): two distinct layers with different purposes.
Invisible vault
Steganographic Vault
A visible encrypted vault is an invitation: it shows every attacker that something valuable lives here — and exactly where to strike. BlindLock takes another route: the encrypted vault hides inside an ordinary image (PNG). Steganography does not replace encryption — it complements it.
An ordinary carrier
The hiding place is an everyday file type: a normal PNG image. It does not advertise itself as a BlindLock vault.
Inconspicuous by design
A vault that does not look like a vault draws far less attention than a visible vault file sitting on your disk.
How a vault ends up inside a PNG
Setting up a vault turns one PNG on your device into your vault.
- You choose the image: a PNG on your device with at least 4.4 megapixels, about 2100 × 2100 pixels. BlindLock checks that your entries fit.
- BlindLock encrypts first. Your passwords, notes and 2FA secrets are encrypted in memory before anything is written to the image.
- The image then takes the encrypted data. To the eye, the image looks the same before and after.
- The file stays exactly where you put it.
What changes inside the image
The encrypted data goes into the pixel values themselves, a tiny fraction per pixel and far too little for an eye to catch. The method is called F5 matrix encoding. It spreads the data so that out of seven positions it could use, at most one has to change. The less that changes, the less the image differs from an untouched one, including for the tools built to look for exactly that.
The payload has no magic bytes, so there is no obvious vault marker to search for. The embedding is designed to resist the classic statistical tests.
Hiding is a layer, not the lock. Encryption and your device are the lock.
What the hiding does
- Attackers look for obvious targets: databases, export files, password folders and cloud vaults. An ordinary PNG is not on that list.
- Encryption answers whether an attacker can read the contents. Concealment answers the question that comes before it: whether anyone even realises there is something to take.
- The carrier is a normal PNG with no telltale extension and no obvious BlindLock marker.
What protects the contents
- Your entries are encrypted twice before they reach the image: AES-256-GCM, then XChaCha20-Poly1305, with independent keys.
- Its key depends on your security chip and on a release from the BlindLock licence server. To sign you in, BlindLock also asks for your master password. Your security chip (TPM 2.0 or Secure Enclave) keeps one part of the key sealed. That part opens only on your device.
- Copy the image to another computer and the device part is missing, so the vault stays closed.
- Even if someone extracts the data, they hold ciphertext and not readable secrets.
Questions about steganography in a password manager
What is a steganography password manager?
It hides your passwords inside another file instead of keeping them in a vault file of its own. BlindLock stores your passwords, notes and 2FA secrets, encrypted, in a PNG image of your choice. Steganography adds concealment on top of encryption.
What image do I need?
A PNG on your device with at least 4.4 megapixels, about 2100 × 2100 pixels. BlindLock checks the capacity before it writes anything, so your entries fit without a visible change.
Can someone tell that my PNG holds a vault?
The payload carries no magic bytes, and the embedding is designed to resist the classic statistical tests. Concealment is still a layer and not the lock. What someone extracts is ciphertext bound to your device.
What happens if someone copies the image?
A copy of the image on its own does not open the vault. Your device and the server release are missing, and the security chip keeps the device part sealed. Read more about hardware binding.
Where do larger files go?
Not into the PNG. Documents, media and archives live in separate encrypted file-vault containers.
Does BlindLock keep a copy of my vault?
No. BlindLock operates no central customer-vault database, and vault contents are never sent to BlindLock servers.
Your next step
Does this match your setup? Then review the security details and secure your licence directly through the pricing page.
Steganography adds concealment on top of encryption — it does not replace it. Even if the carrier is discovered, the payload remains protected by AES-256-GCM, XChaCha20-Poly1305 and hardware binding.
Related guides
Keep reading.
Each guide covers one layer of the local vault model.
Cloudless vault Why your vault lives only on your computer.
Privacy Why BlindLock learns nothing about your vault.
Hardware binding How the security chip binds your vault to your device.
Compare How BlindLock differs from LastPass, 1Password and Bitwarden.
Security Which methods protect what, and which connections exist.
Pricing What Lifetime costs and what it includes.