Image Steganography

What this tool does

Hide a secret message or an entire file inside an ordinary image, then read it back out. The data lives in the least significant bit of each pixel's color channels — a change of at most ±1 per channel, invisible to the eye. Everything runs locally in your browser; nothing is uploaded.

Hiding data

1. Load a cover image (PNG, WebP, or JPEG — click, drag-and-drop, or paste).
2. Choose Text or File and provide the secret.
3. Optionally set a password.
4. Press Hide in image, then Download PNG.

The capacity bar shows how many bytes the image can hold (roughly width × height × 3 ÷ 8, minus a small header). Fully transparent pixels are skipped, since pipelines routinely destroy their color values.

Encryption

With a password set, the payload is encrypted with AES-256-GCM using a key derived via PBKDF2-SHA256 (310,000 iterations) before a single bit touches the image. The salt and IV are random per embed. Without the password the data is unreadable — and undetectable as encrypted.

Extracting

Switch to Extract, load the image, enter the password if one was used, and press Extract. The tool tells apart the failure modes: no hidden data at all, data written by a newer format version, data truncated by cropping or re-encoding, and a wrong password.

The one rule: keep it PNG

The hidden bits are part of the exact pixel values. Re-saving as JPEG, screenshotting, or sending the image through chat-app compression recomputes pixel values and destroys the payload. Keep the downloaded PNG untouched end to end. If an embed succeeded but extraction says "no hidden data", the image was recompressed somewhere along the way.

Verification

After embedding, the result view compares cover and result side by side and reports the stats: pixels changed, max channel delta (always ±1), mean delta, and PSNR — typically above 50 dB, far beyond what eyes or casual inspection can distinguish.

Performance and privacy

Embedding and extraction run in a Web Worker when available, with a main-thread fallback. Your password and secret are never persisted — this tool stores no preferences or user data at all.