Steganography is the practice of hiding a secret message inside something ordinary, like a picture, audio file, or video, so nobody knows the message exists.
Steganography is a technique used to conceal information within another medium, known as the cover medium, without noticeably changing its appearance or function. Unlike cryptography, which disguises the meaning of a message, steganography disguises the existence of the message.
For example, a secret message can be embedded into an image by modifying the least significant bits (LSBs) of pixel color values. These tiny changes are generally invisible to the human eye but can be extracted by someone who knows the embedding method.
Key distinction:
The two techniques can also be combined: encrypt a message first, then hide the ciphertext using steganography.
LSB steganography hides secret information by making tiny, nearly invisible changes to the colors of pixels in an image.
Least Significant Bit (LSB) is the rightmost bit in a binary number - it has the smallest impact on the overall value.
11010110 → The 0 at the end is the LSB11010111 → Changed to 1 - only changes value by 1!
In images, changing the LSB in color values (0-255) creates invisible changes to the human eye:
200 vs 201 - You can't tell the difference! 🎨
Formula:
Capacity = (Width × Height × 3) ÷ 8
Breaking it down:
Width × Height = Total pixels× 3 = Three color channels (R, G, B)÷ 8 = Convert bits to bytesThis tool uses a two-layer encoding system for reliable detection and optimal capacity:
The tool automatically selects the minimum LSB mode needed (you can override):
| Mode | Capacity | Visual Impact | Overhead |
|---|---|---|---|
| 1-LSB | Baseline | Invisible (±1) | 7 bytes |
| 2-LSB | 2× capacity | Barely visible (±3) | 7 bytes |
| 3-LSB | 3× capacity | Slight noise (±7) | 7 bytes |
| 4-LSB | 4× capacity | Visible degradation (±15) | 7 bytes |
Switching on Encrypt with password runs your message through AES-256-GCM with a key derived from your password using PBKDF2-SHA256 (600,000 iterations), both from the browser's built-in Web Crypto API. The ciphertext includes a 128-bit tag that detects tampering, and a flag bit in the sentinel marks the image as encrypted so Decode knows to ask for the password.
AES-GCM protects what the message says and detects tampering, but LSB hiding only tries to conceal that a message exists. The magic number and encryption flag make that fairly easy to detect. Security depends on password strength — there is no password recovery.
To encode a message into an image, choose the image you want to use, enter your text and hit the Encode button.
Save the last image, it will contain your hidden message.
Remember, the more text you want to hide, the larger the image has to be. In case you chose an image that is too small to hold your message you will be informed.
Neither the image nor the message you hide will be transmitted over the web, all the magic happens within your browser.
To decode a hidden message from an image, just choose an image and hit the Decode button. Neither the image nor the message that has been hidden will be transmitted over the web, all the magic happens within your browser.