Bit plane analysis is the first technique to try in any CTF image steganography challenge. It works by isolating individual bits from each colour channel and rendering them as a black-and-white image — making hidden patterns, text, or QR codes immediately visible. This guide explains what bit planes are, how to read them, and how to use StegSolve Online to find and extract hidden flags.
→ Open the Bit Plane Viewer — StegSolve Online
What Are Bit Planes?#
Every pixel in an RGB image is stored as three 8-bit integers — one each for Red, Green, and Blue. The value 200 in binary is:
11001000
The eight bits have very different significance:
- Bit 7 (leftmost, MSB): represents 128 — changes here are dramatic and visible
- Bit 0 (rightmost, LSB): represents 1 — changes here are imperceptible
A "bit plane" is what you get when you take one specific bit from every pixel and render it as a black-and-white image. If that bit is 1, the pixel is white. If it's 0, the pixel is black.
A full colour image has 3 channels × 8 bits = 24 bit planes. With an alpha channel: 32 planes. StegSolve uses the first 28 (R0–R7, G0–G7, B0–B7, A0–A7).
What Each Plane Looks Like#
High bit planes (R7, G7, B7 — MSB): These look like a rough approximation of the original image in black and white. Changes in the MSB cause visible colour shifts, so natural images have mostly-natural-looking MSB planes.
Low bit planes (R0, G0, B0 — LSB): In a natural, unmodified photograph, the LSB planes look like random noise — television static. This is expected. The lowest bit of a real pixel value is essentially random.
The key insight: If an LSB plane shows anything other than random noise — text, patterns, shapes, a QR code, or a recognisable structure — data is probably hidden there.
What Suspicious Planes Look Like#
Text in a Bit Plane#
The most common CTF technique. A flag like flag{hidden_in_r0} is embedded in the R0 plane using standard LSB encoding. When you view R0, you see white text on a black background (or the reverse), often in the top-left portion of the image where encoding starts.
What to look for: Any readable characters in what should be random noise.
QR Code in a Bit Plane#
Less common but instantly recognisable. The flag is encoded as a QR code and embedded in a bit plane. StegSolve Online auto-detects QR codes in every plane during the initial scan.
What to look for: A grid pattern with finder squares (the three corner squares of a QR code) in what should be noise.
Repeating Pattern#
Some challenges embed data in a tiling pattern. If you see a repeating geometric pattern in a low bit plane, it's likely intentional encoding.
Unusually Smooth or Dark Plane#
A bit plane that is entirely black (or white, or very uniform) indicates the channel was zeroed out or set to a constant — sometimes used to hide data in the most significant planes rather than the LSBs.
Clear Image in a Low-Bit Plane#
If a low bit plane (R1, G1, B1) shows a clear recognisable image — not just noise — this often means a secondary image was hidden by embedding it into those bits. This is the image-in-image steganography technique.
How to Use the Bit Plane Viewer#
Open StegSolve Online and upload your challenge image.
Step 1: Check the Auto-Scan First#
The auto-scan runs immediately on upload. If it found something in a specific plane, it tells you which one and what it found. Jump to that plane directly.
If auto-scan found nothing, proceed to manual analysis.
Step 2: Open Grid View#
Click the Bit Planes tab. Grid view shows all 28 planes as thumbnails simultaneously. Scan for:
- Any thumbnail that doesn't look like random noise
- Thumbnails with visible structure, text, or patterns
- Planes marked with warning indicators (elevated chi-square, flag detection)
Grid view is the key advantage over the original StegSolve — instead of clicking through 28 planes one at a time, you see all of them at once. A suspicious plane stands out in seconds.
Step 3: Zoom Into Suspicious Planes#
Click any thumbnail to open it in single view. Use the zoom controls (1×, 2×, 4×, 8×, 16×) to inspect at pixel level. The pixel inspector shows the exact RGBA values of any pixel you hover over, along with its bit values.
At 16× zoom on a small image (64×64 or 128×128 pixels), individual pixels become 16-pixel blocks — you can read embedded text character by character if needed.
Step 4: Extract Data from the Plane#
When you find a suspicious plane, switch to the Extract tab. The channel/bit combination that matches what you saw in bit plane view is what you should extract.
For example, if R0 showed readable text:
- Set Red Bit 0: ☑
- Row order, MSB first (defaults)
- Click Extract
The output panel shows the extracted bytes as hex and ASCII. If a flag pattern is found, it's highlighted.
Common Bit Plane Patterns and What They Mean#
"Random noise on all planes"#
This is either a genuinely unmodified image, or the payload is encrypted (random-looking ciphertext embedded in LSBs looks the same as natural noise).
Next steps:
- Run chi-square analysis — it detects statistical anomalies even in random-looking planes
- Try brute-force extraction — the payload may be there but needs the right settings
- Try AES password: if the challenge suggests encryption, extract R0+G0+B0 and try to decrypt
"MSB planes look strange"#
If R7, G7, or B7 doesn't look like a dark version of the original image, data may be hidden in the high bits. This is unusual but used in some challenges where the image manipulation needs to be visually imperceptible (the lower bits) but detectable (the modified high bits reveal a pattern when isolated).
"Only one channel looks suspicious"#
Some encoders only use one channel (e.g., only the green channel). If G0 shows text but R0 and B0 look like noise, extract G0 only:
- Set Green Bit 0: ☑ (all others unchecked)
- Row order, MSB first
- Extract
"Different bit, not bit 0"#
Some challenges embed in bit 1 or bit 2 instead of bit 0. If bit 0 is clean but bit 1 shows a pattern, extract bit 1 of the suspicious channel.
Chi-Square Analysis: Confirming Steganography Without Seeing It#
When a bit plane looks like noise but you're not sure if it's natural or embedded, chi-square analysis provides a statistical answer.
LSB steganography tends to equalise adjacent pixel value pairs — 200 and 201 appear at nearly equal frequency after embedding, but at their natural (unequal) frequencies in unmodified images. Chi-square detects this equalisation.
The Statistics tab in StegSolve Online shows chi-square values per channel:
- Values below 0.2: likely natural image (no embedding)
- Values above 0.5: statistically suspicious — likely embedded data
- Values near 1.0: strong indicator of LSB embedding
If chi-square is elevated on a channel but the bit plane looks like noise, try extracting that channel anyway. The payload may be encrypted, making it visually indistinguishable from noise while still statistically detectable.
The Steganography Analyzer runs a more comprehensive version of this test (plus RS Analysis, Sample Pairs, and Primary Sets) as a standalone tool.
Practice: What to Try on a CTF Challenge#
For any image challenge without other hints:
- Open StegSolve Online, upload the image — read the auto-scan card
- Go to Bit Planes → Grid View — spend 30 seconds scanning all thumbnails
- Open suspicious planes in full view, zoom to pixel level
- Check Statistics — look at chi-square values per channel
- Go to Extract, try R0+G0+B0 Row MSB (most common CTF configuration)
- If nothing: run Brute-Force — it tests 200+ combinations automatically and ranks by readability
- Check Chunks for PNG metadata and appended bytes
Most standard LSB CTF challenges resolve at step 2 or 5. The brute-force tab eliminates the manual parameter guessing that made the original StegSolve tedious.
→ Start bit plane analysis — StegSolve Online
For extracting a payload when you already know the parameters, the Image Steganography Extractor provides a focused single-step interface with the same LSB decoding engine.