How it works

From file to tones

1. The file is compressed with zlib.
2. If you chose a password or key, the compressed data is encrypted (see below).
3. Every byte is split into four pairs of bits, and each pair becomes a 3 ms tone: 600 Hz for 00, 1000 Hz for 01, 1400 Hz for 10 and 1800 Hz for 11.
4. The tones are saved as an 8 kHz, mono, 8-bit WAV file.

Decoding measures which of the four tones is strongest in each 3 ms slice, then reverses the steps. It only works on WAVs saved by bitbased: audio that has been played aloud and recorded, or converted to a format like MP3, won’t decode.

Why the WAVs are so big

Each byte takes four tones of 24 samples each, so every byte of compressed data becomes 96 bytes of audio. Text compresses well; photos, videos and archives usually don’t. WAV files can’t be bigger than 4 GB, so larger output is saved in the RF64 format instead. bitbased decodes RF64, but many audio players can’t play it.

Encryption

• Data is encrypted with AES-256-GCM in 1 MiB segments, using your browser’s built-in cryptography.
• Passwords are turned into keys with Argon2id (64 MiB of memory, 3 passes), which makes guessing passwords slow and expensive.
• Each WAV gets its own encryption key, derived from your password or key file with HKDF and a random salt.
• Every segment is checked when decoding. Any change to the file, including its header, reordered or missing segments, or a cut-off file, is detected, and nothing is saved.

What others can see

The start of every WAV holds a small header that isn’t encrypted: the format marker WKV2, whether the file is encrypted (and with a password or a key), the saved file type if you chose to include it, and the random values needed to decrypt. The size of the WAV also shows roughly how big the compressed data is. Everything else is encrypted.

Without encryption, anyone who knows the format can decode the WAV, and changes can’t be detected.

Privacy

bitbased is a static website. Encoding and decoding happen in your browser, and nothing you choose or type is sent anywhere. Large files are written to your browser’s private storage while they’re being made, then downloaded.

Browser support

Chrome or Edge 102+, Firefox 114+, or Safari 16.4+. In Chrome and Edge you choose where to save before a job starts.