BSDetector
Tools/Detectors & Checkers

Steganography Decoder

Find text hidden in the pixels of a PNG, BMP or WebP image. This steganography decoder tries the common LSB layouts, checks for data glued on after the end of the file and shows every bit plane. Free, in your browser, no sign-up.

Drop an image here, or click to pick one

PNG, BMP, GIF or WebP. JPEG opens too, with a caveat.

No upload. The image is read by this browser tab and nowhere else.

How this steganography decoder works

Image steganography decoder: reading the low bits

The image is drawn to an off-screen canvas with colour management switched off, so every red, green, blue and alpha value comes back exactly as stored. The page then walks the pixels left to right, top to bottom, takes the lowest bit of each value, and packs every eight bits into a byte. First it reads four bytes as a big-endian length, the format most online encoders use, and takes that many bytes after it. Then it tries again without a header, reading until a zero byte or 4 KB.

The LSB steganography layouts it tries

Encoders disagree about order, so the same read runs over a small table of layouts: RGB with one bit per channel, RGBA including alpha, two bits per channel, all the red bits first then green then blue, and each colour channel on its own. That is 14 attempts in total. The results that decode as UTF-8 and are at least 80% printable characters (90% without a header) are listed, best first.

Data after the end of the file

A PNG ends with an IEND chunk, a JPEG with the FF D9 marker, a BMP and a WebP state their size in the header. Anything past that point is ignored by image viewers, which makes it the laziest hiding place there is: copy /b photo.jpg + secret.zip out.jpg on Windows and done. The page finds that point, measures what follows, names it by its magic bytes and lets you save it.

The bit plane viewer

Picking one bit of one channel and painting it black or white is the oldest trick in steganalysis. High bits show the picture. Low bits of a natural photo look like grain that still follows edges. Data written into the low bits looks different: flat, even static with a hard edge where the message stops.

Hidden, not verified

A readable result means those bits happen to form text. With a length header and a long message, that is almost never chance. Short results without a header can be coincidence from flat colour areas, so treat a four-letter hit with suspicion.

What is steganography

Steganography is hiding a message inside something that looks innocent, so nobody knows there is a message to look for. The word is Greek for "covered writing", and Johannes Trithemius put it on the title of a book written around 1499 that was itself a cipher manual dressed up as a book of magic. Herodotus describes a message tattooed on a shaved scalp and sent once the hair grew back, and twentieth-century spies used invisible ink and microdots the size of a full stop.

Steganography vs cryptography. Cryptography hides what a message says. Steganography hides that it exists. An encrypted email is obviously secret; a holiday photo with a message in its pixels is not. They are often combined: encrypt, then hide, so a found payload is still unreadable.

How LSB steganography works, with numbers

Take one pixel with red 200, green 117, blue 54. To hide the bits 1, 0, 1, overwrite the last bit of each value:

ChannelBeforeHidden bitAfter
Red200 = 110010001201 = 11001001
Green117 = 011101010116 = 01110100
Blue54 = 00110110155 = 00110111

Each value moved by at most one step out of 255. One pixel carries three bits, so a letter such as "H" (01001000) needs eight values, just under three pixels. A 1920×1080 image has room for about 760 KB, far more than any note.

Why JPEG breaks it

JPEG does not store pixels. It splits the picture into 8 by 8 blocks, turns each into frequencies, rounds the fine ones hard and throws most of them away. On opening, the pixels are rebuilt from what is left, and the lowest bit of each value comes out as whatever the rounding produced. Save an LSB image as JPEG, or upload it somewhere that re-compresses, and the message is gone. That is why steganography tools online ask for PNG or BMP, and why JPEG-native tools hide data in the frequency coefficients instead.

Other places data hides

Metadata

EXIF comments, XMP fields and PNG text chunks can hold any string, and most viewers never show them. It is the first place a CTF puzzle hides a flag. The photo metadata viewer and remover lists every tag and block in a file.

Trailing bytes and embedded files

A ZIP appended to a JPEG is still a valid JPEG and, because ZIP readers look from the end, often a valid ZIP too. Rename it to .zip and open it. The trailing data check above catches this.

Audio steganography

WAV files get the same LSB treatment as images, one bit per sample. The other classic is drawing text or a picture into the spectrogram, which you see by opening the file in Audacity or Sonic Visualiser and switching to spectrogram view. MP3 compression wipes sample-level LSB data the way JPEG wipes pixels.

Text steganography

Zero-width spaces and joiners between letters can spell out a binary message, or fingerprint which copy of a document leaked. Trailing spaces and tabs (the SNOW tool) and look-alike Unicode letters do the same job. Paste suspect text into the invisible character detector to see them.

Steganography tools for CTFs

This page is the quick browser pass. When it comes up empty, these are the command-line tools people reach for next, roughly in this order.

  • exiftool image.png

    Every metadata field, including comments and PNG text chunks. Flags hide here more often than you would think.

  • strings -n 6 image.png | less

    Any readable run of characters anywhere in the file. Crude and fast.

  • binwalk -e image.png

    Finds files embedded or appended inside the image and extracts them.

  • zsteg -a image.png

    Tries hundreds of LSB layouts on PNG and BMP, far more than this page.

  • steghide extract -sf image.jpg

    For JPEG, BMP, WAV and AU hidden with steghide. Asks for a passphrase; try an empty one first.

  • stegseek image.jpg rockyou.txt

    Cracks a steghide passphrase against a wordlist, usually in seconds.

  • java -jar stegsolve.jar

    Stegsolve: flip through bit planes and colour filters, and extract custom bit orders.

What this tool cannot do

Password-based extraction. Steghide, OpenStego and similar tools derive the bit positions from a passphrase and usually encrypt the payload too. Without the passphrase the bits look like noise. Use steghide or stegseek.

JPEG frequency methods. JSteg, F5 and OutGuess hide bits in the compressed DCT coefficients, which a browser never exposes after it has decoded the image.

Palette tricks and see-through pixels. GIF and 8-bit PNG messages can hide in palette indexes rather than colours. Browsers also store semi-transparent pixels premultiplied, which rounds away RGB low bits wherever alpha is below 255.

Binary or encrypted payloads. The decoder shows results that read as text. A hidden ZIP or ciphertext in the pixels will not pass that test; the bit plane viewer will still show where it is.

FAQ

Steganography questions

What is steganography?

Steganography is hiding a message inside something that looks ordinary, so nobody suspects there is a message at all. The word comes from Greek for "covered writing". Today it usually means data tucked into the pixels of an image, the samples of an audio file, or invisible characters in text. Cryptography scrambles a message; steganography hides the fact that one exists.

How do I decode steganography in an image?

Drop the image into the box at the top of this page. It reads the lowest bit of each colour value in several common layouts, turns the bits back into bytes and shows anything that comes out as readable text. It also checks for data stuck on after the end of the file and lets you flip through bit planes by eye. If nothing turns up, the message is probably in a format this page does not try, such as a password-protected steghide file.

Can I decrypt steganography online?

You can extract it online if the hiding method is a plain one, like sequential LSB with a length header, which is what most free online encoders use. If the message was encrypted before it was hidden, you get the ciphertext and still need the key. Tools like steghide and OpenStego can also scatter bits using a password, and without that password no online steganography decoder can put them back in order.

What is LSB steganography?

LSB is short for the lowest bit of a number, the ones place in binary. Every colour value in a pixel is a number from 0 to 255, and changing its last bit moves it by one step, which no eye can see. LSB steganography writes the message bits into those last bits, usually three per pixel (red, green, blue). A 1000 by 1000 PNG can hold about 375 KB this way.

What are the best steganography tools?

For CTF work: zsteg for PNG and BMP LSB data, steghide and stegseek for JPEG and WAV files hidden with a password, binwalk for embedded files, Stegsolve for bit planes, and exiftool for metadata. For hiding your own messages, OpenStego and steghide are the long-standing free options. This page covers the quick first pass in a browser: LSB variants, trailing data and a bit plane viewer.

Is steganography the same as encryption?

No. Encryption makes a message unreadable but obvious; anyone can see there is a locked box. Steganography makes the message invisible but, on its own, readable to whoever knows where to look. Serious use combines both: encrypt first, then hide the ciphertext, so finding it does not reveal it.

What is text steganography?

Text steganography hides a message inside ordinary text. Modern versions use zero-width Unicode characters between letters, swap look-alike characters, or add trailing spaces and tabs at the ends of lines (the SNOW tool does this). Older examples are acrostics, where the first letter of each line spells the message. Our invisible character detector finds the zero-width kind.

Why does the decoder find nothing in my image?

Either there is nothing there, or it was hidden in a way this page does not try. Common reasons: the image was saved as JPEG or resized after hiding, which wipes the low bits; the tool used a password to scatter the bits; the data sits in the JPEG frequency coefficients (JSteg, F5, OutGuess); or the message is binary, compressed or encrypted and so does not look like text. Check the bit plane viewer for noise in one corner or band, which shows where data sits even when it will not read as text.

Does this steganography decoder work with JPEG files?

It opens them and checks for data after the end-of-image marker, which is a common trick with JPEGs. LSB messages rarely survive in a JPEG though, because saving one throws away and rebuilds the fine detail those bits live in. JPEG-native tools like steghide and JSteg hide data in the compressed coefficients instead, which a pixel reader cannot see.

How is steganography used in cyber security?

Attackers hide malware payloads, configuration and stolen data inside images and audio to slip past filters that only look at file types. Groups have used it to pull scripts from innocent-looking PNGs on public sites and to send commands through social media images. Defenders use steganalysis, the statistics of noise in the low bits, plus strict re-encoding of uploads, which destroys most payloads.