Nyx

TechnoWolf

About this app

Nyx hides an encrypted text message inside the pixels of an ordinary image. The message is sealed with AES-256-GCM using a key derived from your password, written into the the image's RGB channels, and exported as a lossless PNG. To everyone else it is just a picture; with the password, Nyx recovers the exact message.

Features

- Encrypt wizard — pick a cover image (file picker on every platform, camera on Android/iOS), type a message and password, get a stego PNG saved to your vault and ready to share.

- Vault — a grid of your stego images with detail view, share/export, archive, and delete. Metadata lives in SQLDelight; image bytes live as PNG files on disk.

- Decrypt — open a vault image or pick any image, enter the password, reveal and copy the hidden message. Wrong password and no-hidden-message are reported honestly and distinctly.

- Themes — five palettes with a system/light/dark mode override, persisted across launches.

- Ad-free, account-free, network-free — Nyx makes zero network calls. Your images and secrets never leave your device.

Security model (please read)

- The security layer is the cryptography, not the steganography. Messages are encrypted with AES-256-GCM; keys derive from your password via PBKDF2-HMAC-SHA256 with 600,000 iterations and a random 16-byte salt, with a fresh random nonce per message. GCM is authenticated encryption — a wrong password or a modified image is detected and rejected, never silently decrypted into noise.

- LSB steganography is an obscurity layer. The codec scatters the embedded bits across the whole image with a keyed permutation to deny clustered regions to RS / sample-pair steganalysis — but assume a capable adversary can still detect that something is hidden. What they cannot do without your password is read it.

- PNG only survives lossless channels. Messaging apps and social networks that recompress images (usually to JPEG) destroy the payload. Share the stego image as a file, not as an inline photo.

- Your password is the whole game. A weak password falls to offline guessing regardless of iteration count. There is no recovery mechanism: lose the password, lose the message.

- Clean break from pre-rewrite Nyx. Images produced by the old (pre-2026) Android app use an abandoned format and cannot be decrypted by this version.

Nyx is an experimental open-source project provided under the MIT license, without warranty of any kind. It builds on well-reviewed primitives, but it has not been independently audited. DO NOT rely on it as your only protection for high-stakes secrets.

What’s new

Public release of Nyx