Hide a contact or message in a picture.

Encode a Ratspeak contact or encrypted paper link, or decode an image you received.

Everything runs locally in your browser.Images, contacts, paper links and passwords stay on your device and are never uploaded.

What do you want to encode? Full contact cardBest for adding a contactIncludes your address and encryption details, so the recipient can import your contact directly. Choose a contact QR saved from Ratspeak, or paste the full card text. Paper messageAn existing lxm:// linkHide a paper message created in Ratspeak. Only its intended recipient can read it in Ratspeak. Longer links may need larger pictures and are more sensitive to resizing. LXMF addressEasiest to copyEasy to copy from Ratspeak. Carries only your address. The recipient may need to wait for Ratspeak to find your encryption details on the network before messaging you. Identity hashIf this is what you haveKeeps your identity hash and derives its LXMF address. The recipient may face the same wait for encryption details.

Your contact

Choose the picture to share

JPG or PNG, up to 20 MB. The image is read only on your device.

Password (optional)

Use a unique password of at least 15 characters (NIST guidance), or a six-word random passphrase (EFF guidance). A password manager can generate one for you.

Your protection depends on how hard your password is to guess. Length alone does not make a reused password or familiar phrase safe. Anyone with the image can keep trying guesses on their own computer.

Leave empty to let anyone read the hidden contact. Forgotten passwords cannot be reset.

Encryption & password recommendations

Packrat uses AES-256-GCM with a 128-bit authentication tag. PBKDF2-HMAC-SHA256 derives the key using 600,000 iterations and a fresh random 128-bit salt. Each encryption uses a fresh random 96-bit nonce. This slows guessing; a weak password can still be cracked. Hidden data can still be detected even when its contents are encrypted.

NIST SP 800-63B-4 requires at least 15 characters for single-factor account passwords and supports password managers, pasting and long passphrases. That sign-in minimum does not establish adequate strength for offline encryption.

The 600,000-iteration setting follows OWASP’s PBKDF2-SHA256 password-hashing guidance. The six-word advice follows EFF’s random-passphrase method.

Keep your passphrase in a password manager and share it separately from the image. Packrat has not received an independent security audit.

Privacy & sharing

For your privacy, encoding, decoding, QR reading and password protection all happen locally in your browser. Images, contacts, paper links and passwords are never uploaded.

Packrat requires no account, includes no analytics, and does not save a history of your work. Your browser may still keep browsing history and downloaded files.

The website host can log your visit, including your IP address. Download and open the offline app to use Packrat without a connection. The initial download can still be logged.

Photo mode has survived Twitter/X, Telegram and Signal in the creator’s tests. Results depend on how an image is sent and received. Test the received image; avoid cropping and resizing.

Hidden data can be detected. A password protects the contents; a short password can be guessed offline. This tool does not verify who a contact belongs to.

Compatible with lxma://, RSCP1 and RSCP2 contact cards and lxm:// paper messages. Paper links are already recipient-encrypted; open them in Ratspeak to read the message and check its sender. An independent tool for Ratspeak.

Hide a contact or message in a picture.

Your image is ready

Contact recovered

Privacy & sharing