Frequently Asked Questions

snapWONDERS Vaultify is our steganography platform. It conceals files inside an ordinary photo or video: the files you want to protect are encrypted with a password you choose, then carried invisibly inside the picture.

To anyone who receives it, the result is just a picture. It opens, it looks completely normal, and nothing about it suggests anything else is there. Only someone with the password can take the hidden files back out.

Vaultify is free to try, needs no account, and runs at vaultify.snapwonders.com — as well as on Tor and I2P.

Hide a file →  ·  Reveal a file →

They solve two different problems, and Vaultify uses both together.

• Encryption hides the contents of a file. Anyone can see the file exists — they simply cannot read it.
• Steganography hides the existence of the file. Nothing announces itself as protected, because to all appearances it is an ordinary photo.

Put another way: encryption is a locked safe. It does its job, but a safe in the middle of the room tells everybody you own something worth locking away. Steganography is what makes the safe look like a bookshelf.

Vaultify encrypts your files first and conceals them second, so the contents are protected and the fact that there are contents at all is not advertised.

In most countries, yes. Concealing your own files for privacy — personal records, sensitive documents, private photographs — is lawful, and it is what Vaultify is built for.

Two honest caveats:

• A handful of jurisdictions restrict or regulate encryption tools. If you are somewhere that does, that law applies to Vaultify as it would to any other tool. We cannot advise you on it — nothing here is legal advice.
• Concealment does not change what is being concealed. Using Vaultify to hide unlawful material is unlawful, and our Terms of Service prohibit it.

It takes a few minutes, and no account:

1. Go to Vaultify — Hide.
2. Upload the file or files you want to conceal.
3. Upload the photo or video that will carry them. This is the file you will end up sharing, and it will look completely ordinary.
4. Choose a strong password. It is the only key to what you are hiding, and it cannot be reset or recovered, so store it somewhere safe before you go further.
5. Download the result. It looks and opens exactly like an ordinary picture, with your files encrypted inside it.

Before you send it on, read how to share it safely — some apps re-compress pictures, and that destroys what is hidden inside.

Whether someone sent you a Vaultify file or you are retrieving your own:

1. Go to Vaultify — Reveal.
2. Upload the photo or video that carries the hidden files.
3. Enter the password that was set when they were hidden.
4. Download what comes out.

Without the correct password, the hidden files cannot be read.

If Reveal finds nothing, the most likely cause is that the file was re-compressed somewhere along the way — usually by being posted to social media, or sent as a photo rather than a file in a chat app. See sharing hidden files.

We would rather answer this honestly than sell you a magic invisibility cloak that makes everything vanish forever, because your safety may depend on the difference.

To a person looking at the file: no. There is no visible difference and nothing to notice. It opens as a normal photo or video in any viewer and will not draw a second glance.

To a determined forensic examiner: possibly. Steganalysis is a real discipline. An expert specifically looking for concealed data, with the tools and the motive to run that examination, may find signals that a file has been processed. That is true of consumer steganography generally, and we are not going to pretend Vaultify is the exception.

So: Vaultify is resistant to casual detection, but it is not forensic-proof. It is built to keep a private file private from ordinary scrutiny.

What holds either way is the content. Your files are encrypted before they are concealed. Someone who suspects a file has been through Vaultify — even someone who can demonstrate it — still cannot read what is inside without your password.

If your threat model includes a professional forensic examination by an adversary with real resources, no consumer steganography tool, ours included, should be the thing you rely on.

Today, on a free account: images, video, and audio. Several at once, concealed inside a single photo or video.

Other file types — PDFs, Office documents, spreadsheets, text files, ZIP and other archives — come with a Pro account, which arrives alongside the new pricing. If you add one of those to a free job today, it is simply left out of the result and the result page lists what was skipped, so nothing ever happens silently.

For the photo or video that will carry your hidden files, you can upload JPEG, PNG, WebP, AVIF or HEIC images, and common video formats.

What you get back is always a lossless format: PNG, WebP, AVIF or HEIC. That is a requirement, not a preference. A lossy format discards pixel data when it saves, and the hidden files live in that data — lossless output is what keeps them intact.

On Windows, AVIF is the format to pick. It is the best-supported lossless option there — see why HEIC output can be awkward on Windows.

This is the most common way people lose their hidden files, so it is worth thirty seconds of your time.

Send the result as a file, not as a photo. Facebook, Instagram, X, and the ordinary photo-sending path in WhatsApp and Messenger all re-compress every image they receive. The picture arrives looking fine. What was concealed inside it does not survive the re-compression.

Ways that work:

• An email attachment.
• A cloud storage or file-transfer link.
• Chat apps — if you choose “Document” or “File” instead of “Photo”. WhatsApp, Telegram and Signal all offer this, and it sends the file untouched.

Ways that do not: posting it to a social platform, or letting a messaging app send it down the photo path.

If you are unsure whether a file survived the trip, run the copy that arrived through Reveal and check before you rely on it.

Then the hidden files are gone, and we cannot get them back for you.

There is no password reset, no recovery email, no support process that unlocks a file, and no master key. This is not us being unhelpful: a recovery route for you would be a recovery route for anyone else who got hold of the file, and it would defeat the entire point of the product.

Two habits worth forming:

• Put the password into a password manager the moment you set it.
• Before you delete your originals, run the finished file through Reveal once, to confirm the password works and the contents come back out.

Seriously — it is the reason the platform exists, not something bolted on afterwards.

The essentials:

• Your files are not kept. They are deleted when your result link expires — see how long we keep them.
• They are never sold, shared, mined, or used to train anything.
• You need no account to use the core tools, so there is nothing to link your activity to.
• You can go further and use snapWONDERS over Tor or I2P (with Lokinet coming soon), which keeps your IP address out of it entirely.

The full detail — what we collect, why, and for how long — is set out in our Privacy Policy and Terms of Service.

Your result is reachable through a link with an expiry you choose when you set the job up. Free accounts can pick anything up to 1 day; longer durations are a Pro feature.

When the link expires, the files behind it are deleted. The files you uploaded are removed once the job that used them has finished.

The safe habit is simply to download your result and keep your own copy. Nothing on our side is meant to be permanent storage — Vaultify is a workshop, not somewhere to leave things.

Your file is not corrupted. This is a gap in Windows, and it catches people out.

Vaultify's HEIC output is encoded losslessly, because lossless is what keeps hidden data intact. Windows does not ship a codec that reads lossless HEIC, and neither the free HEIF Image Extensions nor the paid HEVC Video Extensions from the Microsoft Store add one. So Windows Photos cannot open it — even though the file is perfectly valid and opens fine on Apple devices.

Your options:

• Use a viewer that can read it: ImageGlass or XnViewMP — both free, both handle it.
• Just reveal it: upload the file to Reveal. Your hidden files come back out regardless of what your own machine can display.
• Choose AVIF next time: on the options page, pick AVIF as the output format. It is equally lossless, compresses just as well, and Windows can display it.

An encrypted ZIP protects the contents. It does nothing about the far more revealing fact that you are carrying an encrypted archive.

That fact travels with the file. It is plain to anyone who sees your drive, your inbox, or your upload. Some networks flag encrypted archives, some mail filters strip them, and a locked container is an invitation to demand the key — from you.

A photograph or video invites none of those questions, because that is all it appears to be.

It also does more than a ZIP ever could:

• A whole set fits inside one ordinary file. A single photo can carry a stack of other photos; a single video can hold an entire album of photos and videos — and, with a Pro account, documents alongside them. See what you can hide.
• You can lock away the private few inside the ordinary many. Say you have a family album, or a set of work photos, and a handful of them are confidential. Rather than pulling those out into a separate, obviously-locked archive, you conceal them inside one of the ordinary photos or videos in the set. The collection still looks like exactly what it is — holiday snaps, a site walkthrough — while the private handful travel hidden in plain sight, unlocked only by your password.

Vaultify does not make you choose: your files are encrypted and concealed. You get what the ZIP gives you, without announcing that you wanted it.

Yes — and very few steganography tools do.

Vaultify runs on the same Tor hidden service and I2P address as snapWONDERS, with the full feature set. Nothing is held back on the darknet: hide, reveal, analyse and convert all work identically, and there is no configuration to do beyond opening the address in Tor Browser or an I2P-configured browser.

The official addresses — check them carefully against clones — are on Browsing Safely.

They moved to snapWONDERS Vaultify, which is now the home for every tool that changes or protects a file: hide, conceal, regenerate, scrub, anonymise, and copyright stamping.

Nothing is broken. The old snapWONDERS links for those tools redirect to Vaultify, so an old bookmark still lands in the right place.

What stays on snapWONDERS is everything that inspects a file: analysis and conversion. The full picture is on What's Changing.

Upload it at Analyse, and we read back everything the file is quietly carrying: embedded metadata, GPS coordinates, device and serial identifiers, editing history, timestamps, copyright fields, and the technical fingerprints left by the camera or app that made it.

No account is needed, and you get a report you can read before you decide whether that file is safe to share.

If you want the revealing parts removed, that is what Vaultify is for.

Same tool, same place: upload it at Analyse.

Video carries as much identifying detail as a photograph, and often more — recording device, software chain, timestamps, location, and stream-level metadata that most people never see. The report lays it out for you.

Every photo and video you take is written with a second, invisible layer of information alongside the picture itself. You do not see it, you did not choose it, and it travels with the file wherever you send it.

Typically that includes:

• Where you were — GPS coordinates, often accurate to a few metres.
• What you used — camera or phone make, model, and sometimes a serial number unique to your device.
• When — the exact moment of capture, and often of every edit since.
• What you did to it — the software that touched it, and traces of the editing history.

This matters because it identifies you and your habits long after you have forgotten the file exists. A holiday photo can carry your home address, because that is where you first opened the camera app that day.

Analyse a file and see what yours is carrying.

Images: JPEG, PNG, WebP, AVIF, HEIC, GIF and more.

Video: MP4, MOV, WebM, MKV and other common container formats.

Archives: ZIP, RAR, 7-Zip, TAR and others are accepted too — we extract the contents and analyse each file inside individually, so you can check a whole batch in one upload.

If you need a format we do not read yet, tell us — that is genuinely how the list has grown.

Analysis surfaces signals, and signals are not proof. It is important to be straight about what that means in both directions:

• A flag is not evidence that something is hidden. Unusual structure has innocent explanations — unusual software, an odd export path, an old camera.
• A clean report is not evidence that nothing is hidden. Good concealment is designed not to show up.

What analysis is genuinely good at is telling you when a file is not what it appears to be, and giving you specific, checkable reasons to look closer. Treat it as a starting point for judgement, never as a verdict.

Partly — and anyone claiming a definitive yes or no is overselling.

What we can do is read the file's provenance. Where an image carries C2PA Content Credentials (the emerging standard for recording what made a file and what has been done to it since), we read them and show you what they say. Increasingly, cameras and the major AI image generators write these credentials, and where present they are the strongest evidence available.

We also surface the technical signals in the file: the editing history, the software chain, and the internal inconsistencies that often accompany a manipulated image.

What we will not do is hand you a confident verdict on an image with no credentials. Signals are signals. The absence of Content Credentials proves nothing at all — most files still have none.

Upload your files at Convert, choose the format you want out, and download the result.

You can convert, resize, and compact in the same pass, and you can queue up a batch — several files converted at once, then downloaded together.

Like the rest of the platform, it needs no account, and your files are deleted after your session.

200+ image formats and 350+ video formats, including everything most people actually need: JPEG, PNG, WebP, AVIF, HEIC, GIF and TIFF; MP4, WebM, MKV and MOV; and the RAW formats the major camera makers use.

PDF pages can be converted to images as well.

If you are converting a file in order to hide something inside it afterwards, note that Vaultify output has to be lossless.

The official snapWONDERS v3 onion address is:

http://swonderstzr43aczpcwdoyc25vwxngyromja7pyb5sf26ap3v535sxqd.onion

Check it character by character. Cloned and imposter sites are a real problem on Tor, and the only defence is the address itself. If it does not match this one exactly, it is not us.

Open it in Tor Browser — the whole platform is there, including Vaultify. More detail on Browsing Safely.

The official snapWONDERS I2P address is:

http://6ymp5jqysizmejdwaqiehcsgjoyb4s7sbgssquishk66drujomka.b32.i2p

The short form, which your I2P router can look up for you:

http://snapwonders.i2p

Check the address against this page before you trust it. As on Tor, imposter sites exist, and the address is your only proof.

More detail on Browsing Safely.

Because for some of the people who need these tools most, the ordinary web is the problem.

On the clearnet, we can see your IP address. So can your internet provider, and so can anyone positioned between you and us. For most visitors that is an acceptable trade. For a journalist handling a source's material, someone documenting abuse, or anyone in a place where the wrong metadata is dangerous, it is not.

Tor and I2P remove that exposure: we never learn where you are, because the network does not tell us. It costs us nothing to offer, and for the people who need it, it is the whole point.

Every feature works identically on all three networks. Nothing is held back for the clearnet.

Yes — a third network is on the way.

Lokinet is an onion-routing network run by the Oxen Service Node Network, the same infrastructure behind the Session messenger. Its advantage over Tor and I2P is that it works at a lower level: once you have installed the Lokinet client, any ordinary browser can reach a Lokinet address with no proxy to configure.

We plan to add a Lokinet address once the current platform modernisation is finished. When it launches it will appear on Browsing Safely alongside our Tor and I2P addresses.

Yes. The ordinary site is served over SSL/TLS, so the connection between your browser and us is encrypted — look for the padlock in the address bar, as you should on any site you are uploading files to.

What SSL does not hide is your IP address, which is visible to us and to your internet provider. If that matters for what you are doing, use Tor or I2P instead; both are fully supported.

For the tools — hiding, revealing, analysing, converting — yes. That is a deliberate design choice, and on the darknet it works in your favour rather than against it.

The reason is uploads. Vaultify uploads use the TUS resumable-upload standard, which breaks a file into small chunks and confirms each one before sending the next. When a Tor circuit rotates or an I2P tunnel rebuilds mid-transfer — which is routine — the upload resumes from where it stopped instead of failing and forcing you to start over. That coordination happens in JavaScript; there is no server-only equivalent.

On the darknet this is not the privacy risk it would be on an ordinary site. Every script is self-hosted and served from the same onion or I2P address you are already on — there are no CDN calls and no third-party requests, so there is nothing to leak. Fewer page reloads also means fewer round-trips and fewer chances for timing correlation. The site runs at Tor Browser's Standard security level.

Reading pages like this FAQ work without JavaScript — it is the interactive tools that need it. The full reasoning is on What's Changing.

Yes. Analysis, conversion, and Vaultify hide and reveal are all free to use today, with no account and no payment details.

A free account has some limits — see file sizes and counts and which file types you can hide — and a Pro tier is on the way to lift them, as part of the pricing changes covered in What's Changing.

For the website tools — analysing, converting, hiding and revealing — no. They all work without one, and we deliberately do not gate the core tools behind a sign-up.

An account is worth having if you want to keep track of your jobs and come back to past results. And there is one thing that does need it: the API. Its documentation is open to browse, but making calls requires an API key, which you generate from your account. So — the website, no account needed; the API, yes.

Everything is free to use right now. As part of the wider changes underway at snapWONDERS, we are moving from the original pricing to a new model built around Vaultify — and while that transition is happening, the tools stay free.

A Pro tier will sit alongside the free one when the new pricing lands. It lifts the everyday limits: hiding documents and other non-media files, more files per job, longer-lived result links, and higher quality when you use a video to carry your files.

That is also why you might occasionally meet a limit today — those larger allowances are part of Pro. Where it happens, such as a free job that includes a PDF, Vaultify tells you plainly rather than quietly dropping the file.

Any single file: up to 500 MB.

Hiding, on a free account: up to 30 files concealed in one job.

Analysing: up to 20 files per job, so a batch of holiday photos goes through in one pass.

Archives are unpacked and their contents counted individually, so a ZIP of 200 photos is 200 files, not one.

These are the free limits; Pro raises them.

It already is one account. snapWONDERS and Vaultify share a single login — sign in once and you are recognised across both, with no separate credentials and no switching between services.

Your account and profile live at snapWONDERS, which handles sign-up, login, and password recovery. If you already had a snapWONDERS account — including one from the earlier platform — it has carried across automatically, so there is nothing new to set up.

And if you would rather not sign in at all, Vaultify's core tools still work with no account.

Your files need no action: they are deleted automatically when your result link expires, whether or not you have an account. See how long we keep them.

You can ask us to delete your account and the personal data attached to it at any time — just contact us and we will action it. How we handle your data, and your rights over it, are set out in the Privacy Policy.

Yes. The best place to start is the Developers hub — a guided walkthrough from your first call through the API, MCP, and the SDKs. The reference material:

• Interactive documentation (Swagger UI): /vaultify_api
• OpenAPI 3 specification: /vaultify_api/openapi.json — point a code generator at this and it will write your client for you.
• Health and status: /vaultify_api/status

The older snapWONDERS API documentation site has been retired, and API access across the two platforms is being brought together — see What's Changing.

Create an account, then generate a key under account settings → API keys.

Send it as the X-Api-Key header on your requests. Treat it as a credential: it identifies you, so keep it out of client-side code and out of your git history.

Yes. Vaultify exposes an MCP (Model Context Protocol) endpoint, so an AI assistant or agent can use the platform as a tool rather than you driving it by hand.

• Endpoint: POST /vaultify_api/mcp
• Transport: MCP Streamable HTTP, JSON-RPC 2.0
• Protocol revision: 2025-03-26

Point any MCP-compatible client at it — Claude among them — and the tools become available to the model directly. The Developers hub has copy-paste client configs, and the API documentation covers the rest.

Yes. The API is reachable on all three networks, at the same paths — only the host changes.

Tor:

http://swonderstzr43aczpcwdoyc25vwxngyromja7pyb5sf26ap3v535sxqd.onion/vaultify_api

I2P:

http://6ymp5jqysizmejdwaqiehcsgjoyb4s7sbgssquishk66drujomka.b32.i2p/vaultify_api

or the short form, which your I2P router can look up for you:

http://snapwonders.i2p/vaultify_api

Your client needs to route through the relevant proxy, and after that nothing changes: same endpoints, same payloads, same keys.

Kenneth Springer is the founder of snapWONDERS, and he built it because of an idea that was not his.

That idea was Huey's — that digital media could carry personal stories, reaching the people they were meant for and staying invisible to everyone else. Huey was legally blind from the age of four, and he will be forever sixteen to us. It still feels like yesterday that we lost him — some things are timeless — and the idea outlived him to become the foundation of everything here. Accessibility and privacy are not features that were added to this platform. They are the reason it exists.

The whole arc — Hueyify in 2014, the patent, the years between, and what came after — is on Our Story.

Kenneth's own site: kennethbspringer.com.au.

Because he is the reason there is anything here to ask questions about.

Huey Springer was legally blind from the age of four, and had an idea worth outliving him: that digital media could carry stories inside it — reaching whoever they were meant for, invisible to everyone else. Hueyify, in 2014, was the first attempt at building it. We lost him at sixteen; snapWONDERS and Vaultify are what his idea became.

The quote at the top of this page is his, and it is not decoration. “I have a Question!” is what he said, constantly, to everyone, about everything. A page full of questions seemed the right place to keep it.

Read the full story →

Since February 2026, snapWONDERS has been undergoing a modernisation, and the tools are being split by what they actually do.

• Staying on snapWONDERS: everything that inspects a file — deep photo and video analysis, metadata inspection, and format conversion.
• Moved to Vaultify: everything that changes or protects a file — hide, conceal, regenerate, scrub, anonymise, and copyright stamping. Old links redirect, so nothing is broken.
• Already done: a single unified account — one login across snapWONDERS and Vaultify, with earlier accounts migrated across.
• Coming: a single unified API, a mobile app, and a third privacy network (Lokinet).

The detail, and where each piece stands, is on What's Changing — and new features are announced to the newsletter before they go live.

One is on the way — a mobile app for iOS and Android is being built.

You can put your name down at Vaultify Mobile and we will tell you when it lands. In the meantime the site works on a phone browser, including in Tor Browser on Android.

G'day. We are in Victoria, Australia — a state renowned for having four seasons in an afternoon.

That means Australian law and Australian privacy obligations apply to us, which is worth knowing when you are choosing who to trust with a file.

Contact us — it reaches a person.

If you have found a security vulnerability, please use the disclosure process instead, so it lands in the right place immediately.

In full, here: Terms of Service.

In full, here: Privacy Policy — what we collect, what we do with it, and what we do not do with it.

The short version of the part most people are asking about: your files are deleted when your result link expires, and they are never sold, shared, or used to train anything. See how snapWONDERS handles your privacy.

The site, its content, and the works on it are copyright snapWONDERS™.

Some graphics are co-owned or carry their own conditions, so please do not reuse them without asking.

goldenSoftwareENGINEERS® is a registered trademark of Golden Software Engineers Pty Ltd.

snapWONDERS™ is a trademark of goldenSoftwareENGINEERS®.

Please do — we would much rather hear it from you than find out the hard way.

The process, the scope, and what you can expect from us is set out in our Vulnerability Disclosure Policy. Researchers who report in good faith under that policy are welcome here.