Pixel Scramble & Restore
Password-scramble an image by shuffling its pixels with a PBKDF2-derived permutation, then restore it with the same password. Runs entirely in your browser and embeds the salt in the PNG. Obfuscation, not encryption.
Obfuscation, not encryption.
Pixel positions are shuffled, but pixel values are unchanged. This is a visual lock, not a substitute for AES or another authenticated encryption scheme. Do not use it for sensitive material.
PNG output · salt embedded
or drop it here
PNG, JPEG, WebP, or GIF · up to 25 MB
Minimum 8 characters. Longer passphrases are safer. There is no recovery if you forget it.
PBKDF2-SHA-256 · 210,000 iterations · fresh 128-bit salt per image · maximum 4000 × 4000 pixels.
Your scrambled PNG appears here
The salt is embedded in the PNG. The password is the only thing you need to remember.
Every operation uses Canvas and Web Crypto in this tab. There are no backend calls, uploads, or hidden storage.
Under the hood
How it works
No black box: every transformation on this page is a documented browser API running on your device.
This is deliberate obfuscation, not encryption. Pixel values are unchanged; only their positions are shuffled. Someone with enough resources could still analyze the image. Use real encryption for confidential material.
- 01
Derive a key and salt
Your password is stretched with PBKDF2-SHA-256 and 210,000 iterations using a fresh 128-bit random salt. A 256-bit seed drives a deterministic xorshift128 stream.
- 02
Build a permutation
A seeded Fisher–Yates shuffle creates a unique ordering of every pixel index. The same password, salt, and dimensions always reproduce the same ordering.
- 03
Shuffle and embed
Raw RGBA bytes are rearranged on a canvas while preserving alpha. The salt and a password verifier are stored in a PNG tEXt chunk, so restoring needs only the PNG and password.
- 04
Invert to restore
Restoring derives the same permutation and writes each scrambled pixel back to its original index. A wrong password is detected by the verifier before you download a garbage image.
Common questions
Frequently asked
Short answers about how pixel scramble works and where its limits are.
Is this real encryption?
No. Pixel scrambling hides the visual structure of an image, but the pixel values themselves are untouched. It is closer to a digital puzzle than to AES encryption. Do not use it for medical, financial, or otherwise sensitive material.
Can I recover the image without the password?
No. The permutation is derived from the password and a random salt. There is no recovery key or backdoor. Keep the password and the scrambled PNG; losing either makes restoration impractical.
Why must the scrambled image stay a PNG?
PNG is lossless and can carry the salt in metadata. Re-saving or converting the scrambled image to JPEG alters pixel values, which would corrupt the permutation and make restoration impossible.
Is the password or image uploaded anywhere?
No. PBKDF2, the shuffle, canvas rendering, and PNG creation all run inside this browser tab. You can disconnect from the internet after the page loads and the tool will keep working.
All processing happens locally in your browser.
Your tool input is never uploaded. Google AdSense supports the site and may use cookies for advertising.
Keep working
Timestamp Converter
Translate Unix time in seconds or milliseconds into readable dates—across any timezone.
Base64 Encoder / Decoder
UTF-8 safe Base64 conversion with a URL-safe mode and live validation.
Image ↔ Base64
Convert images to data URIs or restore Base64 text files—without sending files to a server.