Safe by default
Ignore the BBP payload and the file is still a valid image with its redacted regions intact.
Open image format · BBP v1
A safer image. Built into the file.
BBP carries a useful, redacted image for everyone — then lets compliant viewers reveal individual regions only when they hold the right private keys.
Standard viewers see the safe base.2 encrypted regions
BBP principles
Private pixels
Each face or region is an independent encrypted entity. The same file can reveal different regions to different viewers.
One ordinary file
BBP adds a JUMBF payload to a normal image carrier. No special server or file extension is required.
Reference implementation
Make one. Open one.
The complete example runs locally in your browser. Protect regions with X-Wing public keys, download a BBP image, and reveal it again with the matching private seed.
Publish locally
Encrypt a photo
Draw regions over a photo, assign each one to a public key, and create a BBP-enabled image.
Demo image pre-loaded, or upload an image to replace it. The original stays in this browser tab.
Protect faces
Encrypted regions
Regions can be encrypted using a public key. Assign each region to the person who should be able to reveal it.
Recipients
Add public keys
These keys encrypt regions of the image. Keep each matching private seed with the intended viewer.
Upload a photo, add public keys, then draw squares.
Publish
Download as
BBP keeps the base image in the format you choose. WebP, JPEG, and PNG export here; HEIF is already supported as a carrier by the reference library.
Open locally
View a BBP image
Load an encrypted image, then reveal only the regions your private keys can open.
Demo image pre-loaded, or load a BBP-enabled image to inspect its safe base and encrypted regions.
Reveal locally
Private keys
Load a private key to reveal the regions it can open. Keys stay in browser memory and are never uploaded.
The format
A small payload, a clear contract.
BBP is an additive image format. The normal image is the privacy floor; the encrypted payload is a capability layer for compliant viewers.
At a glance
- Payload
- Deterministic, definite-length CBOR
- Container
- JUMBF superbox with label brightblur.bbp
- UUID
- 6262702d-4242-5031-9c1d-4e7aa5330001
- Entities
- Shuffled face and intersection boxes
- Safe base
- Full scene with protected regions pixelated
- Crypto
- Per-entity AEAD and X-Wing recipient wraps
Wire shape
Payload = {
v: uint,
entities: [ Entity, ... ]
}
Entity = {
kind: "face" | "intersection",
body: bytes, // AEAD ciphertext
wraps: [ Wrap, ... ] // opaque recipients
}
// A compliant viewer paints every entity
// it can open over the safe base.Safe by construction
Non-compliant viewers render the base and ignore the ancillary payload. Losing the BBP payload loses the reveal capability; it never exposes a hidden original.
Honest limits
The base still reveals the scene and the detected mosaic geometry. BBP protects the selected regions, not the existence of the photograph. A downloaded file is a frozen snapshot.
Carrier adapters
Bring BBP to the image you already have.
The payload is the same JUMBF superbox. Only the small binding that places it into the image changes.
WebP
Ancillary RIFF JUMB chunk. The default for the browser demo and a strong photo carrier.
Read · write · web exportJPEG
BBP JUMBF payload in JPEG APP11 segments, with fragmentation for larger metadata.
Read · write · web exportPNG
Private ancillary bBPj chunk with a valid PNG CRC.
Read · write · web exportHEIF
Top-level ISO BMFF uuid box. The carrier implementation exists in @brightblur/bbp.
Read · write · web readReference implementation
Start with the pieces, not a platform.
The implementation is deliberately split into a format package, a viewer element, and this small static app. Use the package directly or embed the viewer in an existing product.
@brightblur/bbp
CBOR payloads, X-Wing recipient wraps, detection, and carrier embedding/extraction for WebP, JPEG, PNG, and HEIF.
<bbp-viewer>
A framework-neutral custom element. Give it a URL or File, then use instance keys or one shared keyring for the page.
apps/bbp-preview
The page above is the runnable reference: local redaction, key assignment, export, and reveal with no server dependency.
Swift preview
A fully native macOS preview app reads ordinary and BBP image files, exposes the metadata inspector, and uses the same Rust crypto core.
URL or File source
URLs work declaratively when the response is same-origin or CORS-enabled. Browser files and byte buffers use the src property.
<bbp-viewer
id="viewer"
src="/photo.bbp.jpg">
</bbp-viewer>
input.onchange = () => {
const file = input.files?.[0];
viewer.src = file ?? null;
};One keyring per page
Shared keys update every current viewer and become the default for viewers connected later. An explicit instance value remains an override.
import {
setBbpViewerPrivateKeys
} from '@brightblur/bbp-viewer';
setBbpViewerPrivateKeys([
privateKey
]);
viewer.privateKeys = [overrideKey];
viewer.useSharedPrivateKeys();Encode and view
import { bbpEncode } from '@brightblur/bbp';
import '@brightblur/bbp-viewer';
const bytes = await bbpEncode({
base: redactedImageBytes,
faces: [{
bbox,
epoch: 0,
pixels: crop,
recipientPublicKey
}],
intersections: []
});
viewer.src = bytes;
viewer.privateKeys = [privateKey];Adapter contract
To add a carrier, preserve the same payload and implement the four boundary operations below. Then add the carrier to detection and the public dispatch. Keep the binding ancillary so ordinary decoders still render the safe base.
type CarrierAdapter = {
detect(bytes): boolean;
embed(base, jumbf): Uint8Array;
extract(file): Uint8Array | null;
strip(file): Uint8Array;
};Where to look
packages/bbp/src/container.ts contains the carrier dispatch and the WebP, JPEG, PNG, and HEIF bindings. packages/bbp/src/encoder.ts assembles the CBOR payload; packages/bbp-viewer/src/index.ts performs local trial-decryption and composition.
Conformance direction
The format document is the normative starting point. The current implementation is a reference for the draft, not a claim that the draft has completed its independent security audit or final test-vector freeze.