Image Steganography — Hide & Extract Secret Text in Images

How to hide a secret message in 4 steps

No install, no account, no upload — everything below runs on your own device.

How steganography compares to other approaches

A quick reference for choosing the right tool — and understanding why this one combines several techniques instead of relying on just one.

The complete guide to image steganography

What is image steganography?

Image steganography is the practice of concealing secret data — text, a password, a small file — inside an ordinary-looking image so that anyone glancing at it sees nothing unusual. The word comes from the Greek steganos ("covered") and graphein ("writing"): covered writing. Unlike encryption, which scrambles a message into obvious ciphertext, steganography hides the very fact that a secret exists. A photo with a hidden 5,000-character message looks pixel-for-pixel identical to the human eye as one without — the difference lives entirely in bits nobody normally inspects.

A short history of steganography

Hiding messages in plain sight long predates computers. Ancient Greek accounts describe messages tattooed on a messenger's shaved scalp, hidden once the hair grew back, and wax tablets scraped clean and re-carved with a hidden layer of text beneath a harmless cover message. Invisible inks — made from substances like lemon juice or milk that darken only when heated — were used for centuries in espionage and wartime communication. During the Second World War, intelligence services used "microdots": entire pages of text photographically shrunk to the size of a printed period and hidden inside ordinary letters. Digital image steganography, which emerged alongside consumer computing in the 1990s, is the direct descendant of these techniques — instead of ink or film grain, it manipulates the least-significant bits of pixel data, a medium invisible to the naked eye in exactly the same spirit as invisible ink was to the naked hand.

How image steganography works

A digital photo is just a large grid of numbers — every pixel stores a red, green and blue value, each from 0 to 255. Steganography tools exploit the fact that changing a color value by 1 (say, from 142 to 143) is imperceptible to human vision, while a computer can read that exact bit reliably. By systematically replacing the lowest bit(s) of chosen pixels with the bits of a secret message, a program can smuggle in kilobytes of data without visibly altering the image. Extracting the message later just means reading those same bits back out, in the same order, and reassembling them into bytes.

LSB (Least Significant Bit) steganography, explained

LSB is the specific technique this tool uses, and the one most commonly taught in introductory cybersecurity and digital forensics courses. Every 8-bit colour channel value has a "most significant bit" (worth 128, dominating how the colour looks) down to a "least significant bit" (worth only 1). This tool lets you choose how many of those low bits to use — from 1 bit per channel (invisible, lower capacity) up to 4 bits per channel (much higher capacity, with a small risk of faint visible artifacts in flat/plain areas, which the bit-depth preview strip lets you check before committing). It also lets you choose which colour channels participate (red, green, blue) and how pixels are ordered — sequential from the top-left (simplest, most statistically detectable), password-scattered (pseudo-random order seeded from your password, much harder to fingerprint), or texture-preferred (favouring busy, high-detail regions where small changes are naturally camouflaged by existing noise).

Encryption vs. steganography — use both

These two techniques solve different problems and work best together. Encryption (this tool uses real AES-256-GCM via your browser's Web Crypto API, with a password stretched through 200,000 rounds of PBKDF2) makes a message unreadable without the correct key — but an encrypted blob is obviously "something," inviting scrutiny. Steganography hides that something exists at all — but if someone does suspect an image and runs it through any generic LSB extractor, an unencrypted message comes out in plain text. Combining them means a suspicious image reveals nothing to a casual extractor, and even a determined attacker who does extract the payload is left with useless encrypted noise instead of your actual message.

Why use steganography at all?

Beyond espionage-movie scenarios, ordinary reasons people use steganography include: sending a private note to a friend without an obvious "look, a secret" flag; learning how a foundational digital-forensics technique actually works (this tool's Analyze tab exists specifically for that); digitally watermarking your own photos with an invisible ownership marker; embedding recovery information or metadata inside an image file itself rather than a separate document that could get lost; and, for security students and CTF (capture-the-flag) competitors, practicing both sides — hiding and detecting — of a well-known category of challenge.

Supported image formats

You can upload a cover image as JPG, PNG, or WebP — this tool re-renders it to a raw pixel canvas before embedding, so the input format doesn't matter. The output, however, is always a PNG, because PNG's lossless compression is the only common web format guaranteed to preserve your embedded bits exactly. BMP and TIFF are also lossless and would theoretically work, but they produce far larger files for no benefit over PNG in a browser context, which is why PNG is the standard choice for LSB steganography tools. Never convert, screenshot, or re-save the output as JPEG, and never send it through an app that silently re-compresses photos (see the WhatsApp/Instagram warning below) — any of those will destroy the hidden data.

How capacity is calculated

Capacity depends on three things: image size (more pixels means more places to hide bits), how many colour channels you use (red, green, blue — up to 3), and how many bits per channel you spend (1 to 4). Roughly, capacity in bytes ≈ (pixel count × channels used × bits per channel) ÷ 8, minus a small fixed header that stores the format version, encryption flag, bit-depth, channel mask and a SHA-256 integrity hash of your payload. The live capacity bar in the Hide tab calculates this exactly for your current image and settings, and turns red if your secret content (plus password encryption's small overhead) won't fit — at which point you can pick a bigger image, use more bits per channel, or shorten the message.

Password protection done properly

This tool's password field isn't cosmetic — it drives real AES-256-GCM encryption with a unique random salt and IV generated for every single hide operation, and the key is derived from your password using PBKDF2 with 200,000 iterations (a deliberately slow, computationally expensive process designed to make password-guessing attacks impractical). If you also choose password-scattered pixel ordering, the same password (via a separate SHA-256-derived seed, never the raw password itself) determines the pseudo-random order pixels are used in — meaning someone would need both the correct password and knowledge of the embedding scheme to even locate the hidden bits, let alone decrypt them.

Security best practices

• Always keep encryption on, and use a genuinely strong, unique password — not something reused from another account.
• Prefer password-scattered ordering over sequential for anything more sensitive than a casual note; sequential embedding is the easiest pattern for statistical steganalysis to flag.
• Keep bit-depth at 1 or 2 bits per channel unless you specifically need the extra capacity of 3–4 bits — lower bit-depth is both less visually risky and less statistically detectable.
• Send the resulting PNG only as a raw file/document attachment (email, cloud storage link, direct file transfer) — never as an in-app "photo" through a messaging platform that re-compresses images.
• Treat this as a privacy tool, not an unbreakable one — see the Digital Forensics section below before relying on it for anything high-stakes.

Data integrity & corruption detection

Every hide operation stores a SHA-256 hash of your (optionally encrypted) payload in the image header. When you reveal a message, the tool recomputes that hash from the extracted bytes and compares it — if they don't match, you get a clear "corrupted" error instead of silently returning garbage. This catches the most common real-world failure mode: an image that was resized, cropped, filtered, or re-compressed after hiding, all of which alter pixel values enough to flip embedded bits without necessarily being visible to the eye.

Privacy: what actually happens to your data

Nothing. Your cover image, secret message or file, and password are read directly into your browser's memory via the File API and Canvas API, processed with JavaScript's Web Crypto API for encryption, and never touch a network request. There is no server component to this tool at all — open your browser's developer tools and watch the Network tab while you use it; you'll see no outgoing requests carrying your data. Closing the tab clears everything from memory, and nothing is written to disk unless you explicitly click download.

Why browser-based processing makes sense here

For a tool that handles secrets and passwords, "nothing ever leaves your device" is a much stronger privacy guarantee than "we promise not to log it" from a server-based tool. Modern browsers expose everything needed for real steganography and cryptography — the Canvas API for pixel-level image access, the File API for local file handling, and the Web Crypto API for standards-compliant AES-GCM and PBKDF2 — meaning there's no technical reason a tool like this needs a backend at all, and every reason not to have one.

Digital forensics & detectability

Image steganography is a well-studied topic in digital forensics, and detection ("steganalysis") is an active field on the other side of the same coin. Statistical techniques like chi-square analysis (built into this tool's Analyze tab) look for patterns LSB embedding tends to leave behind — specifically, sequential LSB replacement tends to equalize the frequency of adjacent pixel values in a way natural image noise doesn't. More advanced forensic techniques include RS (Regular-Singular) analysis, sample-pair analysis, and machine-learning classifiers trained on large datasets of known stego images. The honest takeaway: LSB steganography, including scattered and texture-aware variants, can raise suspicion under serious forensic scrutiny, especially at higher bit-depths or on images that get analyzed at scale. It is well suited to casual privacy and learning; it is not a substitute for dedicated operational security against a well-resourced adversary.

Cybersecurity applications

Beyond personal use, steganography shows up throughout cybersecurity: security courses and certifications use LSB embedding as the canonical teaching example for both hiding and detecting hidden data; CTF (capture-the-flag) competitions frequently include steganography challenges built on exactly this kind of pixel manipulation; malware researchers study steganographic techniques because some malicious tools have used image-embedded payloads to smuggle data past naive content filters (which is precisely why security teams run steganalysis on inbound images in some high-security environments); and digital watermarking — a legitimate, closely related technique — uses steganography-like embedding to mark ownership of digital media in a way that (ideally) survives normal editing.

Who actually uses image steganography

Educational uses: students and self-learners exploring how hidden-data techniques and their detection actually work at the byte level, rather than reading about it abstractly. Business uses: lightweight internal watermarking of proprietary images, or embedding recovery contact information directly inside a distributed asset. Personal uses: sending a private note, password, or small file to a specific person without an obviously "encrypted" attachment drawing attention, or as a fun, technically interesting way to share a surprise or puzzle.

Common mistakes to avoid

• Sharing the image through chat apps as a "photo" instead of a file attachment — this is by far the most common reason people report a message "not working."
• Editing the output afterward — any crop, resize, filter, or re-save destroys embedded bits, even if the visual change looks trivial.
• Skipping the password "because the message isn't that important" — anyone who suspects steganography and runs a generic extractor gets your message in plain text.
• Choosing 4-bit depth on a low-detail image (e.g. a plain sky or solid-colour background) just to fit more data — this is exactly where artifacts are most likely to become faintly visible.
• Forgetting the password used for scattered ordering — without it, the pixel order used during embedding cannot be reconstructed, and the data is unrecoverable even by this same tool.

Troubleshooting

• "No hidden message detected" — the image was likely re-compressed after hiding (check how it was sent/saved), or it doesn't contain a message from this tool. Try the brute-force check in the Reveal tab as a last resort.
• "Message too large for this image" — use a bigger cover image, increase bits per channel in Advanced settings, enable more colour channels, or shorten your secret content.
• "Incorrect password" on reveal — double-check for typos, extra spaces, or caps-lock; passwords are case-sensitive and there is no recovery option by design.
• "Data is corrupted" / checksum mismatch — the image was very likely modified after hiding (resized, filtered, re-compressed); you'll need the original stego-image.png, unedited.
• Page feels slow on a very large photo — this is expected; bit-level pixel processing is CPU-intensive. Very large images (over ~12 megapixels) are automatically downscaled before embedding to keep the page responsive.

Key features

Summary

Image steganography hides the existence of a message inside an ordinary photo by manipulating pixel bits too small for human eyes to notice; encryption hides its content even if discovered. This tool gives you both, plus the transparency to actually see how hiding and detection work through the Analyze tab, entirely inside your own browser. Upload a cover image above to get started.

Related security & privacy tools