Crucible has six benches. Three read a file apart, three change it. Here's what each one does, how it actually works underneath, and how to use it both ways — pulling hidden things out, and putting your own in. Everything runs in your browser; no file is ever uploaded.
Not a way to send — a way to read what lands in your lap fast, and build a reply just as fast.
Set one shared key in the top-right box. Both sides type the same key — that's the whole handshake. Tick remember here and it stays on this device (in this browser only) so you're not retyping it every time. It's a convenience, not a vault: anyone at your unlocked machine could read it, so treat it like the key it is.
Everything that encrypts or decrypts uses AES-GCM with that key stretched through PBKDF2 (150k rounds). The crypto is strong; the weak point is always key handling, so share the key over a different channel than the messages.
Whatever lands — a photo, a PDF, a file with something welded on, or a blob of text — Crucible reads it:
Hit Build a reply under any decrypted message — it drops you straight into Hide with the cursor waiting. Type, pick how to hide it (in a photo, welded onto a file, or as a text blob), and it's encrypted with the same key on the way out. Hand it back however you like. Crucible never sends anything itself — reading and building is all it does.
Drop in any file and see everything it's carrying — including the parts nobody meant to leave in.
works on: any file typeYou give it a file, it gives you a full report: what the file truly is, its metadata, every readable string inside it, any other files welded onto it, QR codes, and data tucked into image pixels.
Magic bytes. Every format starts with a fixed signature — %PDF, PK for zips and Office files, \x89PNG. Crucible reads those first bytes instead of trusting the extension, so a .jpg that's really a zip gets caught.
Strings. It walks the raw bytes and collects any run of printable characters (both plain ASCII and the UTF-16 that Windows documents use), then flags the interesting ones — flags, URLs, emails, keys, anything that looks like a secret.
Carving. It scans past the start of the file for other formats' signatures. A PNG has a clear end marker; anything after it is a passenger. That's how a zip hidden inside a photo shows up, with a button to pull it out.
Per-format digs. PDFs get their text layer and saved-version count read. Office files get unzipped so hidden or invisible text, leftover comments, and author tags are exposed. Images get their EXIF/GPS read, a QR scan, and a look at their least-significant bits for steganography.
Drop the file. Scan the report top to bottom — the amber panels are things worth a second look, the teal ones are all-clear. If something says "possible LSB-hidden text," that image is probably carrying a message. Hit any Extract button to save a carved file to disk.
Reveal is read-only by design — it's the bench you check your work against. To create hidden things, use Hide, then drop the result back into Reveal to confirm it reads correctly.
Turn gibberish back into text — one encoding, or a stack of them.
works on: text you pastePaste something that looks scrambled and Decode reverses the encoding. It handles base64, base32, hex, binary, decimal, URL and HTML escaping, ASCII85, quoted-printable, Morse, ROT/Caesar/Atbash, Vigenère, XOR, gzip/zlib, and JWTs.
Auto-detect looks at the shape of the input — only 0 and 1 with a length divisible by eight is binary; dots and dashes are Morse; eyJ… is a JWT — decodes with the best match, and scores the result on how much readable English comes out.
Recipes let you chain operations when one layer isn't enough. Real puzzles are often layered — base64 wrapped around gzip wrapped around XOR. You add steps in order and each one feeds the next, so you peel the onion one ring at a time.
Brute-force options exist for the ciphers with tiny key spaces: Caesar tries all 25 shifts, XOR tries all 255 single-byte keys and shows you only the ones that come out mostly readable.
Paste the text and press Auto-detect one layer. If the output is still scrambled, press Send result up to input and detect again — repeat until it's plain. For anything with a key (XOR, Vigenère), add that operation from the dropdown and type the key.
Every codec runs both directions. Add the text → … version of any operation to encode instead of decode. Chain a couple together to wrap your text in layers.
Before you send a "redacted" file, prove the redaction actually removed something.
works on: PDF · Office docs · imagesA black rectangle drawn over text in a PDF hides nothing — the words underneath copy straight out. Verify checks whether that's what happened to your file, and whether earlier versions are still buried inside it.
Text extraction. It pulls the real text layer out of the PDF the same way a copy-paste would. If words you meant to hide come back, the redaction was cosmetic.
Revision counting. PDFs saved on top of themselves keep every earlier version inside. Each save ends with %%EOF; more than one means edit history — and anything "deleted" between saves — is still recoverable.
Office internals. For Word, Excel and PowerPoint it unzips the file and looks for invisible text, leftover comments, and track-changes history.
Drop the file. A clean result is a real result: teal panels mean nothing was recoverable. Any amber or red panel is text or history that will travel with the file when you send it.
Verify only checks — it never changes the file. When it flags a problem, fix it in Redact (to destroy content) or Strip (to remove metadata), then run Verify again to confirm.
Remove the metadata a file carries without you knowing — GPS, names, timestamps.
works on: images · PDF · Office docsShows you exactly what a file is leaking, then hands back a clean copy with that data gone. A phone photo alone can carry the precise coordinates where it was taken and the camera's serial number.
Images are re-drawn onto a fresh canvas and re-saved as PNG. The pixels are identical; the metadata block simply isn't written to the new file. That's a guaranteed clean result rather than a best-effort scrub.
PDFs have their title, author, subject, keyword, creator and producer fields emptied.
Office files get their docProps folder removed — that's where author, company, revision count and timestamps live — and are re-zipped.
Drop the file, read what it found, and download the cleaned copy. Do this to any photo before posting it publicly.
The reverse of Strip is Hide — deliberately putting data into a file — and Reveal shows you what's there in the first place.
Cover something so it is genuinely, unrecoverably gone.
works on: images · PDFYou draw boxes over the parts you want removed. Crucible destroys the pixels beneath them and flattens the page, so there's no text layer and no original underneath to recover. This is redaction that passes the Verify bench.
Images are loaded to a canvas, your boxes are filled solid black into the actual pixels, and the result is re-saved. There was never a separate layer to peel back.
PDFs are the important case. Each page is rendered to an image, your boxes are burned into that image, and a brand-new PDF is built from the flattened page pictures. The original text objects don't survive the trip — which is the whole point. The old way of laying a black box over live text is exactly what Verify catches.
Drop the file, drag boxes over anything sensitive, page through a multi-page PDF (boxes save per page), then Flatten & download. Run the output through Verify to prove it worked — a proper redaction comes back with nothing extractable.
Put a message or a file somewhere it doesn't show.
works on: any payload · image or file carrierConceals what you give it three ways: inside the pixels of an image, welded onto the end of a carrier file, or simply converted to an encoding you can paste anywhere. Any of them can be locked with a passphrase first.
Inside an image (LSB steganography). Each pixel's color values can shift by one without any visible change. Crucible writes your data into those least-significant bits, one bit at a time, behind a small header that records the length. The picture looks identical; the message rides along in the noise.
On the end of a file. Most viewers stop reading at the file's logical end and ignore trailing bytes. Crucible appends your payload after a marker, so the carrier still opens normally but the data is right there for anyone who looks.
Passphrase. When you set one, the payload is encrypted with AES-GCM (the key stretched from your passphrase with PBKDF2) before it's hidden. Without the passphrase it stays locked even if someone finds it.
As an encoding. The plainest option — turn the message into base64, hex, Morse and the like, no carrier needed.
Type your message or attach a file, set a passphrase if you want it locked, pick a method, and create. For the image method, choose a carrier photo — the capacity readout tells you how much fits.
Drop anything Hide made into Reveal. It recognizes Crucible's own header and reads the payload straight back. If it was locked, the passphrase gate is honored — encrypted data stays unreadable without it.