Pass·a·way

A way to pass away a password before you pass away.

Pass-a-way is a steganographic password-preservation tool. It encodes a secret text into two visual images by distributing each pixel randomly between them. Neither image alone reveals the secret — overlaying both reconstructs the original text.

How it works

1. Type your secret text into the browser UI or run the Node.js CLI.
2. The tool renders the text onto a temporary canvas, then walks every pixel.
3. Each pixel is randomly assigned to one of two output images. Empty background pixels get a decoy pattern; text pixels are split so the correct pixel lands in exactly one image.
4. Download or print both images. To recover the secret, overlay them — the pixels re-combine to reveal the original text.

Usage

Browser

Open index.html in a browser after building the bundle:

npm run build:browser

Type your secret (up to 45 characters) into the Secret field. Two steganographic images appear instantly in the page, along with an overlay preview showing the decoded result.

Node.js CLI

npm run build:server
node dist/server/index.js

Or run directly from source (requires the native canvas prerequisites below):

node src/node/index.js

Output images are written to dist/:

| File | Purpose | |---|---| | dist/image0.png | First steganographic share | | dist/image1.png | Second steganographic share | | dist/tempImage.png | Debug image showing the original rendered text |

Installation

Prerequisites — native dependencies for canvas

The canvas package is a native Node.js addon. Install the required system libraries before running npm ci.

Ubuntu / Debian

sudo apt-get install -y build-essential libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev

macOS

brew install pkg-config cairo pango libpng jpeg giflib librsvg pixman python-setuptools

Windows (via Chocolatey)

choco install -y python3 gtk-runtime microsoft-build-tools libjpeg-turbo

Install dependencies

Requires Node.js ^24.

npm ci

Development

# Watch-mode browser bundle (with source maps)
npm run dev:browser

# Watch-mode Node.js (restarts on file change)
npm run dev:node

# Watch-mode linting with auto-fix
npm run lint:watch

# Watch-mode tests
npm run test:watch

Building

# Build both browser and Node.js bundles
npm run build

# Browser only (minified, outputs to dist/)
npm run build:browser

# Node.js server only (bundled with ncc, outputs to dist/server/)
npm run build:server

The dist/ directory is generated output — do not commit files from it.

Testing & linting

npm run test        # Run all tests
npm run coverage    # Run tests with LCOV coverage report
npm run lint        # Check code style (XO / ESLint)
npm run lint:fix    # Auto-fix lint issues

Architecture

index.html             # Frontend UI
dist/                  # Build output (generated — do not commit)

Tech stack

| Area | Tool | |---|---| | Runtime | Node.js ^24 | | Language | JavaScript (ES modules) | | Linter | XO | | Test runner | AVA | | Coverage | c8 | | Browser bundler | esbuild | | Node.js bundler | @vercel/ncc | | DOM emulation | jsdom | | Image rendering | canvas |

License

ISC © Jannis Hell