Encryption. A key for AES-256 is derived from the password with PBKDF2 (210,000 iterations, SHA-256). The text is encrypted with AES-GCM using a random salt and IV. GCM checks integrity: a wrong password or a damaged emoji gives an error, not garbage.
Packing into the emoji. The encrypted bytes (salt + IV + ciphertext) are attached to the emoji as invisible Unicode variation selectors — one selector per byte. Browsers and messengers do not display them, but they survive copy and paste.
Important. The password protects the message, not the emoji. The emoji is only a disguise: anyone can extract the hidden bytes, but without the password they are useless ciphertext. Use a strong password and share it another way.
Type the text, choose a password, pick an emoji and click "Hide in emoji". Copy the result and send it to any chat — the recipient pastes it on the "Reveal" tab and enters the password.
In Telegram, WhatsApp, iMessage, email and most messengers. Some social networks and input fields remove invisible characters — then the secret is lost, and the page will tell you so.
It uses AES-256-GCM with a password-derived key (PBKDF2, 210,000 iterations). Without the password the text cannot be read. Security depends on the password: a long, unusual one is practically impossible to guess.
No. Encryption and decryption happen right in your browser with the built-in Web Crypto API. Neither the text nor the password leaves your device.
Yes, but every byte is a separate invisible character, and some platforms cut very long messages. Keep it short for reliability.