Passcodes & security

Steganography and encryption solve different problems. Steganography hides that a message exists; the passcode is what stands between a discovered image and its payload. Use both properly and you get secrecy in depth.

What the passcode does

When you set a passcode in the Hide panel, revealing the payload requires it — without the passcode, the Reveal operation fails even for someone who knows the image is a stego image and which method was used.

• Choose a passcode like you'd choose a password: length beats cleverness.
• There is no recovery. HILIA doesn't store passcodes; a lost passcode means a lost payload. Keep it in your password manager.
• The passcode travels out-of-band: tell the recipient by a different channel than the image itself.

What steganography protects against

• Casual observation — the image looks and opens like a normal picture.
• Content scanning by filename/type — the payload doesn't exist as a file until revealed.
• Nosy intermediaries — combined with a passcode, an intercepted image yields nothing.

What it does not protect against

• Recompression — platforms that re-encode images destroy the payload (send as a file, not an inline photo — see Hide & reveal).
• Determined steganalysis — statistical analysis can flag that something is hidden, especially with large payloads. Pick a "harder to detect" method and keep payloads small when that matters.
• A weak passcode — discovery plus a guessable passcode equals disclosure.

Operational notes

• HILIA processes images in memory and doesn't retain your files — see the privacy policy.
• All operations run over HTTPS and require your signed-in TYO ID.