Image Steganography

Steganography is the art of hiding that a message exists. Encryption makes content unreadable, while steganography makes it unnoticed. This page uses the simplest technique, known as least-significant-bit hiding. Every pixel in an image stores red, green and blue values from 0 to 255, and changing the lowest bit of a value shifts the colour by a single step, far below what an eye can see. A few thousand such bits are enough for a short note.

How the hiding works

The page decodes your cover image into pixels and walks through them in order. For each colour channel it replaces the lowest bit with the next bit of the payload. The payload is a four-letter marker, a length and then your text, so that the extraction tab can recognise a picture made here and know where the message stops. The result is saved as a PNG, which is lossless and keeps every bit exactly as written.

Capacity

At one bit per channel an image holds three bits per pixel. The built-in sample image is 320 by 200 pixels, which is 64,000 pixels and about 23 KB of room, shown on the page before you hide anything. The sample message uses 34 bytes of that. Choosing two bits per channel doubles the capacity. If the message does not fit, the page says so instead of truncating it.

Using a passphrase

A hidden message with no protection is only obscure. Anyone who knows the technique can pull the bits out and read them. Adding a passphrase makes the page encrypt the text with AES-256-GCM, using a key stretched from the passphrase with PBKDF2 at 600,000 iterations, before hiding the ciphertext. Extraction asks for the same passphrase and reports a failure if it is wrong or the data was changed.

Why sharing breaks it

Most messaging apps and social networks re-encode uploaded pictures, often as JPEG, and often at a smaller size. Lossy compression rewrites pixel values, which wipes out the low bits. Even a screenshot of the image loses the message. Send the PNG as a file or as a document attachment, and extract on the other side from that exact file.

Limits

Least-significant-bit hiding is well known and can be detected by simple statistics, so do not rely on it against a determined analyst. Use it for puzzles, watermarks, teaching and games, and add a passphrase for anything private. Everything happens in your browser, and the cover image and message are not uploaded.

Detecting hidden data

The same technique that hides a message can be turned around to look for one. A cover image with a message in its low bits shows slightly unnatural statistics: the counts of even and odd values in each colour channel become too equal. Analysts use that, and visual attacks that display only the low bit plane, to flag suspicious pictures. A message that fills only a fraction of the capacity is harder to find than one that uses it all, which is another reason to keep messages short and to encrypt them.

Related tools

• AES Encryptor and Decryptor encrypts text or files with a passphrase before you hide them.
• Zero-Width Character Detector finds the text version of the same trick.
• EXIF Data Remover strips metadata from photos.
• File Type Identifier confirms what an image file really is.