Data encoded as spatial color patterns in PNG microdots. Looks like noise or a solid color field.
Every payload encrypted before encoding. GCM mode adds authentication — tampering with a single pixel is detected.
Encryption key derived from passphrase using Argon2id. Requires 64MB RAM per attempt. Brute force infeasible.
Each entry uses a unique 16-byte random salt. Identical plaintexts produce completely different ciphertext.
The index (table of contents) is itself encrypted. An attacker can't determine how many entries exist without the passphrase.