A discreet carrier
The image carries a token; the encrypted message payload is handled separately.
GhostFrame
Use an ordinary-looking image as the carrier for an encrypted retrieval token. The recipient imports the image into City of Hats to retrieve the protected message.
No phone number or email required for core Hat use.

The useful difference
The image carries a token; the encrypted message payload is handled separately.
The app encrypts the message before it is made available through the retrieval workflow.
Review the supported recipient and lifecycle controls when creating the GhostFrame.
How it works
Import a suitable image and compose the protected message.
Set the available controls and export the carrier. Sharing the original as a file helps preserve its pixels.
The recipient imports the image into a supported City of Hats client and follows the retrieval flow.
Know the boundary
Image resizing or recompression may destroy the token; do not assume every social or chat platform preserves it. Steganography does not guarantee undetectability or anonymity. An authorized recipient may retain what they read.
Review the security evidenceQuestions, answered
Open City of Hats to review the controls available for your client, content and plan. The app shows applicable requirements before you proceed.
Verify the recipient, use a supported device and choose appropriate access and retention rules. Review the Security Evidence Center for boundaries and evidence status.
City of Hats is free to use. Feature availability and limits vary by plan and client. Premium is optional; review current limits in the app or on the plans page.
Explore what matters next
Start with a Hat
Start free. Choose your controls as the work requires them.