⌘Ctrl K

Steganography

Hide a text or a file in the pixels of an image, encrypted with a password if you like, and read what one hides, without uploading it

Drop an image here or click to browse The image to hide the message in. You can also paste it. Nothing is uploaded.
Message
With one, the message is encrypted (AES-256-GCM): who finds it can't read it without the password.
How it works
Where
In the lowest bit of the red, green and blue of each opaque pixel, row by row from the top left: 3 bits a pixel, a 12 MP photo holding 4.5 MB
Layout
“304S” and a version byte, a flags byte (encrypted, compressed), the length on 4 bytes, then the message: a byte saying text or file, for a file its name and type, then its bytes. Compressed (deflate) when that makes it smaller
Password
AES-256-GCM, the key derived with PBKDF2-HMAC-SHA-256 (600,000 iterations, a random 16-byte salt), as in AES Encryption: the salt, the IV, then the ciphertext and its tag
Output
PNG, which keeps every bit. JPEG and WebP's lossy compression would change them
It hides the message from the eye, not from analysis: statistical tests spot changed lowest bits, and anyone with this tool reads a message without password. The password makes it unreadable, not undetectable. It reads only the messages this tool hid: other tools lay the bits out their own way. Everything runs in your browser: neither the image nor the message leaves this page.