A Photo You Can Take Back

StegoSafe’s promise is simple and absolute: the secret goes into the photo, the photo stays on your device, and no server is ever involved. That is exactly right for an individual protecting a seed phrase.

It is exactly wrong for an organisation that has to send a credential to one person on Tuesday and stop it from working on Thursday. Once a StegoSafe photo is out, it is out. There is no one to ask.

WaxSeal is the companion product built for the second case, and it starts by separating two things StegoSafe deliberately keeps together: the carrier and the content.

What the photo carries

A WaxSeal photo carries an eight-byte token — a watermark that survives WeChat, WhatsApp, Telegram and Instagram recompression — and nothing else. The token names a seal in the organisation’s vault. On its own it reveals nothing and opens nothing; a screenshot of it is worth as much as a screenshot of a locker number.

The content is encrypted on the sender’s device with a fresh key. That key is then wrapped, one copy per recipient, to each recipient’s device key. Those device keys never leave the Secure Enclave of the phone or Mac they were created in. The vault receives the ciphertext and the wrapped keys, and can read neither.

What “take it back” means

When a recipient opens a photo, their app does five things before showing a character of plaintext: reads the token, fetches the seal, checks the organisation’s signed authorization (a hash-chained snapshot of who belongs and who has been revoked, signed by an admin device, not asserted by the vault), verifies the sender’s signature over the seal, and only then unwraps its key and decrypts.

Every one of those steps is a place where the sender’s organisation can say no, later:

• Revoke a device and the next open fails at step three, on every seal, everywhere.
• Withdraw a seal and the vault has nothing to fetch.
• Limit reads — burn after reading, or three opens — and the vault counts.
• Expire and both the vault and the reading device refuse after the deadline.

What this does not do is reach into a screen that already displayed the secret. WaxSeal’s own documentation puts it in one sentence: expiry and revocation prevent new authorized opens; they are not recall. A product that promises more than that is describing a feature it does not have.

Why the vault cannot cheat

The obvious question about any server in the loop is what happens when it lies. WaxSeal’s answer is that the vault is a relay, not an authority. Membership is a chain of snapshots signed by the organisation’s admin devices; each snapshot names the hash of the one before it. The vault can withhold a newer snapshot, but it cannot forge one, roll one back, or substitute a device’s key — every recipient’s device verifies the chain itself and recomputes device identities from the keys it sees. Withholding is bounded too: a device that has not confirmed the chain with the vault within a day refuses to open until it has.

Joining works the same way. An admin issues a signed invite bound to the organisation, the vault, the invitee’s name and role, and a one-time key. The joining device proves it holds that key over its own new keys. Any current admin can verify the result on their own device and approve with one tap. Nobody reads sixty digits over the phone.

The PIN that is not a joke

Recipients’ devices are already locked with Face ID. So why offer a four-to-eight-digit PIN on a seal?

Because the threat it addresses is the recipient’s own device in the wrong hands, unlocked — borrowed, taken, or opened with someone looking over a shoulder. Against that, a PIN the sender says over the phone is a second factor the device owner might not know.

The trick is what the PIN is not. It is never an encryption key; a short PIN used that way falls to an offline guess in milliseconds. Instead the content key of a PIN seal is bound to a random 32-byte share that only the vault holds. The vault releases the share only against a proof derived from the PIN, allows five wrong attempts, then destroys the seal and tells the sender. Whoever holds the phone gets five online guesses, not a search.

Two products, on purpose

It would have been easy to bolt a server onto StegoSafe and call it “Pro”. We did not, because the two promises cannot share a product. StegoSafe’s value is that nothing leaves your device — ever. WaxSeal’s value is that something does, under rules you keep. Each is honest only because it refuses to be the other.

If you protect your own secrets, StegoSafe is the tool. If your organisation sends secrets to people and needs to stop them later, WaxSeal is — hosted by us, or on servers you run.