Detecting steganography means answering a different question than extracting it: not "what's hidden?" but "is anything hidden, how much, and which method was used?" The Steganography Detector runs four statistical tests on any image or WAV audio file you upload, gives you a probability estimate, and fingerprints the likely encoding method — all without installing anything, entirely in your browser.
This guide walks through the full detection workflow, explains what each test result means, and covers what to do when a result is ambiguous.
What the Steganography Detector Is For#
The Steganography Detector and the Steganography Analyzer serve related but distinct purposes:
- Detector → "Is something hidden? How much capacity is used? Which method?" — forensic classification
- Analyzer → "What's the hidden content? Extract it." — data recovery
Use the Detector when you receive a suspicious file and need to establish whether steganography is present before deciding whether to investigate further. Use the Analyzer when you already suspect a specific encoding method and want to extract the payload.
What Files the Detector Accepts#
- PNG, BMP, WebP (lossless): Full statistical analysis — chi-square, RS analysis, Sample Pairs, Primary Sets
- JPEG: DCT coefficient analysis and RS analysis (pixel-level tests do not apply to lossy formats)
- WAV audio: LSB frequency analysis and amplitude distribution tests on raw PCM samples
GIF, SVG, and document formats are not supported by the Detector — use the Steganography Analyzer for those.
How to Detect Steganography: The Step-by-Step Workflow#
Step 1 — Upload Your File#
Open the Steganography Detector and drag your image or WAV file into the upload zone. The file is processed entirely in a WebWorker in your browser. No data leaves your device.
Step 2 — Wait for the Four-Test Analysis#
The Detector runs four tests simultaneously:
Chi-Square Attack — measures whether adjacent pixel value pairs are abnormally equal in frequency. In a natural image, 128 and 129 occur at different rates. After sequential LSB embedding, they become nearly equal. p-value < 0.05 = not detectable; p-value > 0.5 = strong indicator of sequential LSB.
RS (Regular/Singular) Analysis — groups pixels into regular (R), singular (S), and irregular groups based on local smoothness. LSB embedding increases the S/R ratio in a predictable way. This test detects both sequential and PRNG-ordered LSB because it measures global statistical changes, not spatial patterns.
Sample Pairs Analysis — examines the frequency of pairs of adjacent pixel values. Steganographic embedding perturbs these pair frequencies in a detectable direction regardless of the embedding order.
Primary Sets Analysis — measures the distribution of pixel "closeness" groups. A complementary signal to RS analysis, most effective at medium-to-high payload densities.
Step 3 — Read the Fusion Score#
The four tests produce individual p-values and confidence scores. The Detector combines them using a weighted fusion formula into a single Detection Confidence value from 0.0 to 1.0:
| Confidence | Interpretation | |---|---| | 0.0–0.3 | No steganography detected. File appears clean. | | 0.3–0.5 | Weak signal — inconclusive. Possible light embedding or natural statistical variation. | | 0.5–0.7 | Moderate signal — steganography possible. Investigate further. | | 0.7–0.9 | Strong signal — steganography likely present. Run the Analyzer for extraction. | | 0.9–1.0 | Very strong signal — steganography almost certainly present. |
Step 4 — Check the Method Fingerprint#
Below the fusion score, the Detector displays a Method Fingerprint panel. This identifies the most likely encoding approach based on which tests fired and at what intensities:
- Sequential LSB → chi-square fired strongly, RS moderate
- PRNG LSB → RS fired, chi-square weak (spatial randomization defeats chi-square but not RS)
- Adaptive LSB → all tests weak but non-zero (edge-concentrated embedding leaves subtle residual)
- DCT steganography → chi-square and RS weak; DCT coefficient analysis shows clustering
- Audio LSB → amplitude distribution anomaly in WAV samples
→ Run detection on your suspicious file — Steganography Detector
Upload your image or WAV and get a confidence score in seconds — no install, no upload to any server.
Step 5 — Interpret Capacity Estimate#
When detection confidence is above 0.5, the Detector estimates the payload capacity used: approximately what percentage of the available embedding space is occupied by hidden data. This estimate is derived from the magnitude of the RS ratio deviation and is expressed as a range (e.g., "5–20% of capacity used").
A low confidence score with a "5–10% capacity" estimate suggests a small, well-hidden payload. A high confidence score with "50–80% capacity" suggests a large payload that is easier to detect.
Tested Results: What Real Stego Looks Like#
Test 1 — Sequential LSB, 1-bit RGB, 35-byte message in 1920×1080 PNG:
- Chi-square p-value: 0.74 (detectable)
- RS confidence: 0.41 (moderate)
- Sample Pairs: 0.38
- Fusion: 0.63 (moderate — steganography possible)
- Method fingerprint: Sequential LSB (high confidence)
Test 2 — PRNG LSB, 1-bit Blue channel, same message:
- Chi-square p-value: 0.09 (not detectable — PRNG beats chi-square)
- RS confidence: 0.28 (weak)
- Sample Pairs: 0.24
- Fusion: 0.21 (low — steganography not detected)
- PRNG embedding with AES at under 5% capacity genuinely evades the Detector at this payload size.
Test 3 — Sequential LSB, 2-bit RGB, 200 KB payload in 1920×1080 PNG:
- Chi-square p-value: 0.96 (very detectable)
- RS confidence: 0.89 (strong)
- Fusion: 0.91 (very strong — steganography almost certainly present)
- Method fingerprint: Sequential LSB, 2-bit depth
When Detection Fails: Known Limits#
The Detector cannot reliably detect:
PRNG LSB at low payload density (under 5% of capacity). The spatial randomization defeats chi-square, and the RS ratio deviation is too small to distinguish from natural image variation. Increasing payload size makes detection more reliable.
Adaptive LSB steganography. Adaptive methods concentrate embedding in high-complexity edge regions. Statistical tests that analyze global distributions see a small, ambiguous signal. The Detector reports "weak signal" and cannot determine whether it represents light embedding or complex image texture.
F5 / JSteg (JPEG steganography). These algorithms embed in DCT coefficient space. The pixel-level tests (chi-square, RS) don't apply to JPEG. DCT analysis is available but less reliable than pixel-level tests on lossless images.
Clean images with unusual statistical properties. Medical imaging (CT, MRI), satellite imagery, and computer-generated graphics sometimes have natural pixel distributions that score weakly positive on RS analysis without containing any steganography. The Detector shows "weak signal / inconclusive" for these.
If the Detector returns 0.3–0.5 and you need higher certainty, escalate to full forensic analysis with the Steganography Analyzer, which includes additional tests and bit plane visualization.
Frequently Asked Questions#
What's the difference between the Steganography Detector and Steganography Analyzer? The Detector answers "is something hidden?" and identifies the likely method. The Analyzer answers "what is the hidden content?" and attempts extraction. For forensic triage — when you receive a suspicious file and need to decide whether to investigate — use the Detector first. If it returns high confidence, run the Analyzer to extract the actual payload.
Can the Detector find steganography in JPEG images? Partially. JPEG uses lossy compression that destroys pixel-level LSB data, so chi-square and RS pixel tests don't apply. The Detector runs DCT coefficient analysis on JPEGs instead. This detects some JPEG-specific steganography methods (JSteg, OutGuess at high payload density) but is less reliable than the full pixel-level suite available for PNG/BMP/WebP.
Why does the Detector return a "weak signal" on a file I know contains steganography? The encoding method may be PRNG LSB at low payload density — this is designed to evade statistical detection. Alternatively, adaptive LSB concentrates embedding in textures where statistical tests have reduced sensitivity. A weak signal doesn't mean the file is clean — it means the encoding method is good at defeating statistical analysis.
Does the Detector work on files shared via social media? Social media platforms (Instagram, Twitter, WhatsApp) re-encode images as JPEG at reduced quality, which destroys LSB steganography. If you download an image from one of these platforms, it has already been through a lossy transformation that removes any pixel-level steg. The Detector will correctly return low confidence because the encoding was destroyed by the platform, not because nothing was ever there.
Can I detect steganography in video files? Not directly — the Detector supports images and WAV audio. For video, extract individual frames and run them through the Detector individually. The Video Steganography Extractor handles the extraction side if you suspect a specific video format.