PhantomText is a fully client-side web application that combines cryptography + steganography. Unlike traditional encryption tools that produce obvious ciphertext, PhantomText ensures both absolute secrecy and visual invisibility.

✨ Key Features

• 🔍 Zero-Width Steganography: Invisible text embedding that visually matches standard text.

• 🔐 Strong Encryption: AES-256 encryption using the native Web Crypto API.

• 🧠 Key Derivation: PBKDF2 protects passwords against brute-force attacks.

• 📦 Smart Compression: Utilizes the Deflate API with an automatic LZW fallback for optimal payload size.

• 🛡️ Tamper Detection: SHA-256 integrity verification prevents malicious payload alteration.

• ⏱️ Auto-Wipe Security: Sensitive data and fields are automatically wiped after 3 minutes of inactivity.

• 📊 Real-Time Analytics: Tracks zero-width character bloat and assesses platform compatibility dynamically.

• ⚡ 100% Client-Side: No data leaves the browser.

⚠️ Limitations

• Some platforms (e.g., social media, messaging apps) may strip zero-width Unicode characters, causing hidden data loss.

• Copy-paste operations can remove or normalize invisible characters depending on the environment.

• Not designed for high-security or production-grade use; intended as a proof-of-concept.

• Large messages increase zero-width character bloat and may affect usability.

• Requires modern browser support for Web Crypto API and CompressionStream.

• Encrypted data cannot be recovered if the password is lost.

⚙️ How It Works

Encoding Process

1. Secret message is converted into bytes and hashed via SHA-256 for integrity.

2. Data is compressed (Deflate or LZW) to minimize bloat.

3. Compressed data is encrypted using AES-GCM.

4. Ciphertext is converted into zero-width characters (\u200B, \u200C, \u200D).

5. Invisible characters are injected seamlessly into the visible cover text.

Decoding Process

1. Zero-width characters are extracted from the cover text.

2. Binary is converted back to bytes and decrypted using the user's password.

3. Data is decompressed and integrity is verified against the original SHA-256 hash.

4. The original message is securely revealed.