Steganography Online: Hide and Extract Secret Text in PNG Images

Hide and extract secret messages inside PNG images using LSB embedding, with optional AES encryption.

This tool hides a message inside the least significant bit of every color channel in a PNG image — changes small enough to be invisible to the eye but easy to read back out if you know they're there. It optionally encrypts the hidden message with AES-256-GCM before embedding it, so even someone who detects and extracts the raw hidden bits still can't read the message without the passphrase.

How to hide text in an image

  1. Leave Mode on Hide a message and drop a PNG, BMP or WebP onto the upload zone. A JPEG dragged in gets a warning and embedding stays disabled, so re-save it as PNG first.
  2. Type the message. The capacity bar counts bits used against width × height × 4, including the 72 bits of header, and warns you when the text will not fit.
  3. Optionally enter a passphrase. The message is then encrypted with AES-256-GCM under a PBKDF2-SHA-256 key (250,000 iterations) before embedding, which adds 44 bytes.
  4. Click Embed & prepare download, then Download PNG. The file is named stego- plus your original file name and is always a PNG, whatever format you loaded.

Why only lossless images, and why not through canvas

Least-significant-bit steganography only survives formats that store pixels exactly as written — PNG, BMP, and lossless WebP are accepted, and uploading a JPEG disables embedding entirely with an explicit warning, because JPEG's lossy compression scrambles exactly the low-order bits this technique depends on. For PNG files the tool also avoids reading pixels through an HTML canvas, because canvas premultiplies alpha internally, which can silently alter RGB values in ways that destroy hidden low bits even for an otherwise lossless image; it parses the PNG format directly instead. BMP and WebP covers are decoded by the browser and read through a canvas, which is harmless for hiding since embedding happens afterwards, and the result is always written out as a PNG.

Once a message is embedded, the same lossless discipline applies going forward: downloading and later re-saving the result through anything that recompresses it — a JPEG conversion, a lossy resize — destroys the hidden data just as surely as uploading a JPEG in the first place would have.

How to extract a hidden message

  1. Switch Mode to Reveal a hidden message and load the stego PNG exactly as you received it, not a screenshot or re-saved copy.
  2. If the sender used a passphrase, type it; for a plain-text embed, leave the field blank.
  3. Click Extract message. The tool reads its 9-byte header from the first pixels, checks for the magic bytes STG1 and only then reads the declared number of message bytes.
  4. Copy the revealed text. "No hidden message found" means the image lacks this tool's header or was recompressed; an encrypted message asks for the passphrase, and a wrong one reports that decryption failed.

How much you can hide, and how the tool finds its own data again

Raw capacity is one bit per color channel per pixel — width times height times four channels for a standard RGBA image — of which a fixed 9-byte header is reserved before your actual message: a 4-byte magic value identifying this tool's own format, one flag byte recording whether the payload is encrypted, and a 4-byte big-endian length so extraction knows exactly how many bytes to read back out rather than guessing.

Extraction reads that header first, checks the magic value, and only proceeds to pull out the declared number of payload bytes if it matches — an image with no embedded data, or data embedded by a different tool, is correctly reported as containing nothing rather than returning garbage bytes as if they were a real message.

Sharing a stego image without destroying the message

The hidden bits survive only as long as every pixel value stays exactly as the tool wrote it, so the route you share the file through matters as much as the embedding.

Optional encryption before the bits go in

When you supply a passphrase, the message is encrypted into a self-contained envelope before it ever reaches the pixel-embedding step: a random 16-byte salt, a random 12-byte nonce, and the AES-256-GCM ciphertext (which already carries its own 16-byte authentication tag), derived through PBKDF2-SHA-256 at 250,000 iterations — all built independently from this catalog's separate AES tool, by design, rather than sharing code between them. That's 44 bytes of fixed overhead added on top of your plaintext before it's ever turned into hidden bits.

Wrong passphrase means the GCM authentication tag fails to verify, and decryption throws rather than returning corrupted or nonsensical text as if it were the real message — you get a clear failure, never a plausible-looking wrong answer.

What hiding data in an image doesn't protect against

Questions people ask about Steganography Toolkit

Why won't the tool let me embed a message in a JPEG?
JPEG's compression is lossy and works by discarding exactly the kind of fine per-pixel detail that least-significant-bit steganography depends on, so a message embedded in a JPEG's pixel data would be destroyed the moment the file is saved or re-compressed. The tool detects JPEG files and disables embedding for them entirely, rather than letting you embed data that would already be broken.
How much text can I actually hide in a given image?
Roughly one bit per color channel per pixel, so a modest image already holds a meaningful amount of text — a 500-by-500 PNG has a raw capacity of one million bits, about 125,000 bytes, minus a small 9-byte header and, if you encrypt it, another 44 bytes of overhead for the salt, nonce and authentication tag.
If I extract the hidden data without the right passphrase, what happens?
Nothing readable. If the payload was encrypted, decryption requires the AES-GCM authentication tag to verify against the supplied passphrase, and a wrong passphrase makes that verification fail outright — the tool throws an error rather than returning scrambled or partially-correct text, so you never mistake a wrong guess for a real result.
Can someone tell an image has a hidden message even if they can't read it?
Potentially, yes. Encryption protects the message's content, but it doesn't hide the fact that the image's least-significant bits have been altered, which dedicated steganalysis techniques can sometimes detect statistically. This tool is built for demonstrating and learning steganography, not for a threat model where the mere existence of a hidden message must stay undetectable.
Can I send the image over WhatsApp or social media without losing the message?
Usually not as a normal photo post. Those services tend to recompress, resize or convert uploads, which rewrites the lowest bit of the pixel values and erases the message. Send the PNG as a file or document instead, and test the route by extracting from the copy that arrives.
Does hiding text change the image quality?
Not visibly. Each channel value the tool touches changes by at most 1 out of 255, and only as many values as the header and message need are touched, starting at the top-left pixel. The rest of the image keeps its original values, so the change is statistically detectable but not visible.
Can I hide a file or another image inside an image?
No. The tool hides UTF-8 text typed into the message box, and there is no file picker for the payload. You could convert a small file to Base64 text elsewhere and paste that in, but it would need about a third more capacity than the file itself.
Can this decode images made with other steganography tools?
No. Extraction only recognises this tool's own layout: the ASCII magic STG1, a flags byte and a 4-byte length in the image's first low bits. Other tools arrange their data differently, so their images are reported as containing no hidden message rather than being decoded into nonsense.
Is my image uploaded to a server?
No. Decoding the cover, encrypting the message, embedding the bits and writing the new PNG all happen in your browser tab, and the download link points to a local blob. Neither the picture, the message nor the passphrase is sent anywhere.

Related tools on BrakeTools

Content reviewed 2026-09-27.