Dear Product Hunters,

Spicebag turns a crypto seed phrase into a color-coded PNG and reads it back, word for word. Each word becomes one solid RGB cell in a grid, and the same phrase can be drawn as 10⁴⁷ to 10¹³⁹ different-looking images, so no two copies ever match.

I used to collect generative art NFTs, and I kept coming back to how strange it is that six figures of crypto usually sits on a strip of paper in a fireproof box. That box handles fire and floods, not people: anyone who opens it knows instantly what those words are worth. A random picture on your phone doesn't. Scatter the pixels across dozens of camera photos if you want, and put them back together only when you need to recover.

Decoding is the part I obsessed over, because a backup you can't trust isn't one. It validates the mnemonic checksum, rejects PNGs carrying palette, transparency, or ICC chunks, and fails loudly if lossy compression touched even one cell. You either get your exact phrase back or a rejection. It never guesses. BIP39, Electrum, SLIP39 supported, 12 to 33 words.

The optional salt runs through Argon2id at 256 MB of RAM per guess, expanded by domain-separated HKDF-SHA512. Never stored, any Unicode, no length cap. Guessing a seed phrase outright is much easier than cracking a salted image.

MIT, pip install spicebag, Windows/macOS/Linux. No network code at all. Nothing leaves the CLI, ever.

To be straight about the threat model, however; this won't save you from malware or anyone watching your screen. It's about what your backup looks like while it sits still.

Fun fact: this project was named after the iconic Irish-Chinese takeaway dish. You throw seasoning and salt into a bag and shake it. That's more or less what the encoder does.

Tell me where you'd hide yours. And roast the crypto, I want it to hold up.

Spicebag

Compress crypto seed phrases into secure visual artifacts.

Compress crypto seed phrases into secure visual artifacts.