1 - Write the message that must survive the trip
Passphrase - the only secret, never sent with the message
Key: PBKDF2-HMAC-SHA256, 210000 iterations, then AES-GCM-256. Salt (16 bytes) and IV (12 bytes) are fresh random values for every message.
2 - Pick a cover
Payload position
Payload encoding
Line width
Cover preview (sample cover, payload slot marked):
3 - Encrypt and assemble
ready
Cover text alone (sample data, sent as written)
Payload block alone (the real ciphertext container)
4 - Outgoing text: exactly what leaves the machine
body only - a real client would add From/To/Subject headers around it
What a mail filter can see (computed here, deterministic checks)
| Signal | Measured now | Verdict |
|---|