Steganography

Steganography is a browser tool that hides arbitrary text inside an image by modifying the least significant bits of individual pixel channels — changes so small they are invisible to the human eye. The resulting image looks identical to the original. The secret can only be recovered if you know where to look. Everything runs in your browser; no server ever sees your data or your image.

Overview

LSB (Least Significant Bit) steganography is one of the oldest and cleanest methods for hiding information in plain sight. Each pixel in an RGB image stores three channels (red, green, blue) as 8-bit values. Flipping only the last bit of a channel changes its value by 1 out of 255 — a difference no eye can detect. By distributing the bits of a text message across many pixels in sequence, you can store hundreds of characters in a typical photo with zero perceptible quality change.

This tool implements the full encode and decode cycle entirely in the browser using the Canvas API. Drop in an image, type your message, download the stego image. Share it anywhere. To recover the message, drop the same image into the decode tab.

How LSB Steganography Works

Encoding:

Each character in the message is converted to its ASCII value, then to 8 binary bits. Those bits are written into the least significant bit of consecutive pixel channels across the image.

Message: "Hi"
H → 72  → 01001000
i → 105 → 01101001

For each bit, the target pixel channel's last bit is set to match:

// Write a single bit into the LSB of a pixel channel value
function writeBit(channelValue, bit) {
  return (channelValue & 0b11111110) | bit
}

Before the message bits, the encoder writes a structured binary header: a STEG1 magic marker (40 bits), an 8-bit algorithm ID (0 = plaintext, 1 = AES-128), and a 32-bit payload length. The decoder reads this header first — if the magic marker is absent, it reports "No hidden message found" rather than attempting to decode garbage.

Bitstream layout:
[MAGIC: 40 bits — "STEG1"] [algId: 8 bits] [payloadLen: 32 bits] [payload bits]

Decoding:

The decode pass reads the header first to validate the magic marker and read the payload length, then extracts exactly that many bytes from the LSBs. If algId is 1, the payload is passed to AES-GCM decryption before converting to text.

Features

Encryption Mode

Embedding plaintext is the default, but the tool supports optional AES-128-GCM encryption before embedding. When a password is provided:

1. A 16-byte random salt and 12-byte random IV are generated via window.crypto.getRandomValues
2. PBKDF2 derives a 128-bit AES key from the password — SHA-256, 100,000 iterations
3. AES-GCM encrypts the message; output payload is salt(16) | iv(12) | ciphertext
4. That encrypted payload is what gets embedded into the image LSBs

The algId field in the header is set to 1, so the decoder knows to prompt for a password.

async function aesGcmEncrypt(password, plaintextBytes, bits) {
  const salt = getRandomBytes(16)
  const iv = getRandomBytes(12)
  const key = await deriveAesKeyFromPassword(password, salt, bits)
  const ct = new Uint8Array(
    await window.crypto.subtle.encrypt(
      { name: "AES-GCM", iv },
      key,
      plaintextBytes
    )
  )
  const payload = new Uint8Array(16 + 12 + ct.length)
  payload.set(salt, 0)
  payload.set(iv, 16)
  payload.set(ct, 28)
  return payload
}

Tech Stack

Project Structure

steganography/
├── index.html     # UI — encode/decode tabs, canvas display
├── script.js      # All logic — LSB encoding, AES-GCM encryption, Canvas API
├── styles.css     # Styling
└── images/        # Sample images

Encode / Decode Flow

Limitations and Constraints

JPEG encoding would destroy the embedded bits — the lossy compression rounds pixel values in ways that corrupt the carefully placed LSBs. For this reason, this tool always exports PNG. If a stego PNG is re-saved as JPEG by another tool before decoding, the hidden data will be unrecoverable.

The storage capacity is proportional to image size: a 1000×1000 pixel image has 1,000,000 pixels × 3 channels = 3,000,000 bit positions, which can hold roughly 375,000 characters — far more than any practical message.