Your message. Your image. Your secret.
StegoCrypt encrypts text or files with a passphrase, then embeds the ciphertext inside a PNG image using key-derived randomized least significant bit placement. Nothing is uploaded, stored, or sent to a server.
Authenticated encryption
Passphrase hardening
Lossless output
Privacy checklist
- ✓ Never share the passphrase with the image.
- ✓ PNG is required; JPEG recompression destroys hidden bits.
- ✓ Bigger images and higher bit depth provide more capacity.
- ✓ Embedded files are encrypted before steganography.
No file selected.
Strength: not rated
Preview
Large 4K+ images are processed in chunks so the browser stays responsive.
Strength: not rated
Metadata
1. Encrypt first
Your message or file is optionally compressed, packed with metadata, and encrypted with AES-GCM using a PBKDF2-derived key.
2. Randomize placement
An AES-CTR-based deterministic PRNG drives an unbiased Fisher-Yates shuffle over usable RGB channels.
3. Export lossless PNG
The encrypted payload is written to least significant bits and exported as PNG to preserve every hidden bit.
Why Client-Side Steganography Matters for Security
When you use a steganography tool, you are handling secret data — messages, documents, or files you specifically want to hide. Most online steganography services upload your images and payloads to remote servers for processing. This creates a fundamental security paradox: the very data you are trying to hide passes through third-party infrastructure.
Server-Side Steganography Tools
- ✗ Your secret message uploaded to unknown servers
- ✗ Cover image + stego image both transmitted over the network
- ✗ Server operators could log or retain your payloads
- ✗ No way to verify what happens after upload
- ✗ Passphrase may be transmitted alongside encrypted data
- ✗ Vulnerable to man-in-the-middle interception
StegoCrypt — 100% Client-Side
- ✓ Nothing leaves your browser — no uploads ever
- ✓ Encryption and embedding happen on your device only
- ✓ Passphrase never transmitted anywhere
- ✓ Uses native Web Crypto API (browser-verified)
- ✓ No account required, no tracking, no telemetry
- ✓ Works offline after initial page load
Who Uses Image Steganography?
Steganography serves diverse needs — from cybersecurity professionals to everyday privacy seekers.
Security Professionals
Test covert channels, practice steganalysis, and evaluate hiding techniques for penetration testing and red team exercises.
CTF Participants
Encode and decode steganography challenges for Capture the Flag competitions. Practice LSB extraction and encrypted payloads.
Journalists & Activists
Protect sources and communications by hiding sensitive documents inside innocuous images that look completely normal.
CS Students
Learn how least significant bit encoding, AES encryption, and key derivation work in practice with a hands-on demonstration tool.
Frequently Asked Questions
What is steganography and how does it work?
Steganography is the practice of hiding data within other data so that the hidden content is undetectable to casual observers. In image steganography, secret messages or files are embedded into the least significant bits (LSB) of pixel color values. The cover image appears completely unchanged to the human eye, but the hidden data can be extracted by anyone who has the stego image and the correct passphrase. Unlike encryption alone (which scrambles data but reveals that something is hidden), steganography conceals the very existence of the secret communication.
Is StegoCrypt safe for hiding sensitive data?
Yes. StegoCrypt processes everything locally in your browser using the Web Crypto API. Your passphrase, secret messages, files, and images never leave your device — nothing is uploaded to any server. This is critical: most online steganography tools (stylesuxx, devglab, mobilefish, PELock) send your data to remote servers for processing, which defeats the purpose of hiding sensitive information. With StegoCrypt, the entire encode/decode pipeline runs on your machine.
What encryption does StegoCrypt use and why is it strong?
StegoCrypt uses AES-GCM (Advanced Encryption Standard in Galois/Counter Mode) for authenticated encryption, combined with PBKDF2 key derivation running 600,000 iterations of SHA-256 for passphrase hardening. AES-GCM is the same encryption standard used by governments and security agencies worldwide. The 600k PBKDF2 iterations make brute-force attacks computationally expensive — even with modern GPUs, trying billions of passphrases takes impractical amounts of time. Your data is encrypted before being hidden, providing double protection: encryption and concealment.
Why does StegoCrypt only support PNG images?
PNG uses lossless compression, which preserves every pixel value exactly as encoded. Steganography relies on precise bit manipulation — changing even one bit incorrectly can corrupt the hidden payload. JPEG uses lossy compression that discards pixel information to reduce file size, destroying embedded data in the process. If you save a StegoCrypt image as JPEG, the hidden message will be lost. Always keep and transmit stego images as PNG files.
Can I hide entire files inside images, not just text messages?
Yes, StegoCrypt can encrypt and embed any type of file — documents, photos, archives, code, spreadsheets — inside a cover PNG image. The only limitation is capacity: a 1920×1080 image at 2 bits per channel holds approximately 1.2 MB of encrypted data, while a 4K (3840×2160) image can hold about 4.7 MB. Use the embedding depth control (1, 2, or 3 bits per channel) to balance between capacity and stealth — higher depth means more capacity but slightly more detectable pixel changes.
What is randomized LSB embedding and why is it better?
Basic steganography tools write hidden data sequentially across pixels, creating predictable patterns that steganalysis software can detect statistically. StegoCrypt uses key-derived randomized placement — an AES-CTR based PRNG determines a non-sequential embedding order derived from your passphrase. This scatters the hidden bits unpredictably across the entire image, making statistical detection significantly harder. Even if someone suspects steganography, they cannot extract data without the correct passphrase because the placement order is unknown.
How do I share a stego image securely?
Share the PNG file through any normal channel (email, messaging, social media) — it looks like a regular image. However, never share the passphrase through the same channel as the image. Use a separate secure communication method for the passphrase (e.g., share the image via email, share the passphrase via a different encrypted messaging app). Also ensure the image is not recompressed or converted to JPEG during transfer, as this destroys the hidden payload.