Paint data into a picture.

A piculum is a picture file that also carries data. You paint which pixels hold it. The picture displays anywhere a picture displays. The data comes out only in piculum software, with the password.

Open the workbench White paper npm install piculum

One record, start to finish

1. Someone paints the fields.

The piculum workbench editor with the Travel Card open. The Travel Card is one of the starter templates that come with the workbench, ready to fill. The layer list shows nine named layers, each with a field type, a pixel count, and a usable byte capacity. The Field dropdown is open, listing text, date, number, phone, email, zip, choice, name, state, url, and password, with phone selected for a 306-pixel layer. The paint tools Rect, Ellipse, Brush, Erase, Fill, Drop, and Pan sit above the list.

This is the Travel Card, one of the starter templates that come with the workbench. Each colored region is a field: traveler, emergency contact, two phone numbers, blood type, allergies, insurance, notes. The person who painted it chose where each field sits and what type it is, and the workbench told them how many bytes each region can hold.

2. Someone else fills it in.

The workbench encode panel showing the Travel Card starter template as a form: Traveler, Emergency contact, Contact phone, Embassy phone, Blood type as a dropdown, Allergies, Insurance policy, and Notes, each with its byte count against the field's capacity. An inset from the designer shows the same layers with the Field type list open on phone, and an annotation reads From Piculum Designer.

They never see the painting. They open the Travel Card and get a form. The phone fields are phone fields. Blood type is a dropdown. They type, set a password, and press Encode.

3. Out comes a PNG.

The result is an ordinary picture file. It opens in any image viewer, attaches to any email, sits in any photo library, prints. It looks like the Travel Card. It is the record.

4. Open it with the password.

A record made from the Travel Card starter template, decoded in the workbench: the picture at top, then the fields below it with their captions - Traveler, Emergency contact, Contact phone and Embassy phone rendered as blue tel links, Blood type, Allergies, Insurance policy, and Notes.

Every field comes back under its caption, in piculum software, on any machine. The phone numbers are links. Nothing to parse, nothing to interpret.

5. Try the wrong password.

The workbench Open view for a record made from the Space Power starter template, after a wrong password. The picture displays normally above a password box. Below it a red message reads: Data: Couldn't unlock this - check the password, or the file may be damaged.

The picture still displays. The data does not open. There is no partial result and no garbled text, only a refusal.

That is the whole thing. Design once, fill many times, read anywhere.

What you might use it for

An emergency-info card. Name, date of birth, allergies, medications, a contact. One per family member, on each phone, opened with the family password.
Business paperwork. A registration form, a warranty claim, an inspection record. You design it, customers or field staff fill it, and what comes back is structured every time.
A license badge. Each sale fills the form and issues a small image the customer keeps. An edited or forged badge fails at your decode instead of decoding to something plausible.
A publisher with tiers. Regions can carry their own passwords. The free password opens the hint; the subscriber password opens the solution. Opening one region tells you nothing about the others.

What you should know

It is a tool, not a service. Nothing here needs a server. The workbench encodes and decodes in your browser, with no account and nothing sent anywhere. The same codec runs in Node, so if you do have a server, a pipeline, or a batch job, it does the work there just as well. Where the records live is your decision.

The seal is real. Each field is encrypted with AES-256-GCM under a key stretched from your password, using the browser's built-in WebCrypto. It is the same lock the rest of the internet uses, on purpose.

Send the file, not a picture of the file. The data lives in exact pixel values. Copying, attaching, and downloading preserve it. Screenshots and messengers that recompress images destroy it, and the picture will look fine while they do. The password is the whole key, and so is the mask file if you saved one separately. There is no recovery.

Three more things it does

Fields are optional.

Paint one region and type into it: a message, a file, a whole JSON document. No schema, just a marked place for the content.

The workbench encode panel with Space Power, another of the starter templates that come with the workbench. The Caption layer holds the words My Generator in a rich-text box. The Data layer, on its Text tab, holds a small JSON document describing a portable generator: type, id, item, serial, purchase date, location, two service entries, and a contact. The counter under it reads 378 of 208,470 bytes. — One data layer, no fields defined. A JSON document typed straight into it uses 378 of the layer's 208,470 bytes.

Every encode looks different.

Encode the same data with the same password twice and the pixels differ. The sealed region takes its place in the picture, and it is never the same picture twice.

The workbench showing a decoded record from the Space Power starter template at left, its JSON data listed below it, and two more encodes of the same record side by side at right, outlined in red. All three pictures show the same starry artwork with the caption My Generator, but the colored speckle of encoded pixels differs between them. An annotation reads: these images are the exact same data and password as the first image, but showing that the encoded data looks different every time you encode. — Three encodes of the same record with the same password. The artwork and the decoded data are identical; the encoded pixels are not. These are grabs for illustration, not decodable piculums.

The field map can travel separately.

Untick one box and the map of where the fields sit is saved as a separate small file. The picture then needs that file and the password to open: something you have and something you know.

The Embed mask checkbox in the workbench encode panel, unticked, with its tooltip: Unticked: the mask is saved as a separate .piculum-mask.png file instead - the picture alone can't be decoded elsewhere without it. — The one box. Unticked, the field map goes to a separate .piculum-mask.png file.

And there is more in the workbench than fits on this page: split one region into dozens or hundreds of scattered pieces, auto-populate a picture with regions, pop areas out of the artwork, and other things that are more fun to try than to read about. Open the workbench and paint something.

For developers

The template is a contract. The field definitions travel with the piculum itself, so a program using the piculum library can read a template, discover its fields and capacities, fill them, and emit the record, or take a record and consume it. The codec entry has zero dependencies and runs in browsers and Node; all encryption runs locally on the caller's machine.

npm install piculum pngjs   # pngjs only needed in Node

import { encodeMessage, decodePng } from 'piculum';
import { installNodePng } from 'piculum/node';

installNodePng(); // once, in Node; browsers need nothing

const { png } = await encodeMessage('hello', 'password', 200, 200);
const text = await decodePng(png.blob, 'password');

The codec never needs a key or an account. For environments that can't run it, there is also a hosted developer API (beta): validate and inspect templates, measure capacity, and seal or open records over HTTPS. Your host image never uploads, and the seal and open endpoints process records and passwords in memory without storing them. Free API keys exist for quotas and abuse control, not billing.