Hidden.Irish security: encryption, decoding keys and limits
Hidden.Irish encrypts messages with AES-256-GCM and derives the key with PBKDF2-SHA256 at 600,000 iterations. Masking is a separate experimental transport. The web application receives the message or token and decoding key: this is not end-to-end encryption against the service.
What protects the contents
The encrypted envelope includes a fresh random salt and nonce. AES-GCM authenticates the encrypted contents; a wrong key or changed authenticated data is rejected. Carrier checksums help reject broken image payloads but are not cryptographic authentication.
Use the suggested random 256-bit decoding key when possible. You can enter your own, but a short or reused password remains easier to guess despite the derivation cost. Share the key separately and keep it: the application cannot recover a lost key.
Where data is processed
Encryption and decryption run on the Hidden.Irish server. Images are composed and read in the browser; only the recovered encrypted token and key are sent for decryption. The application does not store messages or keys, but using it requires trust in its hosting and delivered code.
Optional OpenAI generation receives the chosen neutral carrier style and the user's API key, not the secret message, decoding key or encrypted token. It may use paid API credits. Consent-based analytics does not collect form contents.
What is not promised
There is no proof of undetectability, universal social-network survival, or protection from a compromised device or service. Encryption does not hide traffic, account identities or the fact that two people communicate.
Use this experimental tool only where these limits are acceptable. Test with a harmless message first, verify the actual received copy, and keep a backup of the original or encrypted token.