StegoToolkit has two forensic tools with similar-sounding names: the Steganography Detector and the Steganography Analyzer. They solve different problems at different stages of a forensic investigation. Using the wrong one wastes time; using both in sequence is the complete workflow. This guide draws the exact line between them.
Steganography Detector vs Analyzer: The Core Distinction#
Detector: "Is something hidden in this file, and if so, which method?"
Analyzer: "Extract whatever is hidden and tell me what it is."
What Each Tool Does#
Steganography Detector#
The Detector runs four statistical tests — chi-square attack, RS analysis, Sample Pairs, and Primary Sets — and combines them into a single Detection Confidence score from 0.0 to 1.0.
It also produces a Method Fingerprint: based on which tests fired and how strongly, the Detector identifies the most likely steganographic encoding approach (sequential LSB, PRNG LSB, adaptive LSB, DCT-based, audio LSB).
The Detector does not attempt to read or display the hidden content. It is a classification tool, not an extraction tool. You learn that steganography is probably present and what kind — not what the hidden data says.
Supported formats: PNG, BMP, WebP (lossless), JPEG (partial), WAV audio.
Steganography Analyzer#
The Analyzer goes further. It extracts the hidden payload, interprets what it found (plain text, encrypted data, embedded file, compressed data), and presents it for you to act on.
It also includes a Bit Plane Viewer — a visualization tool that renders each bit plane of each colour channel as a separate greyscale image. Hidden data appears as structured patterns in the low bit planes; random noise looks like uniform salt-and-pepper.
The Analyzer runs statistical tests too, but its primary output is the extracted payload itself, not a probability score.
Supported formats: PNG, BMP, WebP, JPEG, GIF, SVG, WAV, MP3, DOCX, PDF.
Side-by-Side Comparison#
| Feature | Detector | Analyzer | |---|---|---| | Primary output | Confidence score + method fingerprint | Extracted payload + interpretation | | Statistical tests | Chi-square, RS, Sample Pairs, Primary Sets | Chi-square, RS (supporting tests) | | Bit plane viewer | No | Yes | | Entropy analysis on payload | No | Yes | | File format support | Images + WAV | Images + Audio + Documents | | Best for | "Does this file have hidden data?" | "What is the hidden data?" | | Speed | Faster (classification only) | Slower (extraction + analysis) | | Batch mode | Yes — process up to 50 files | No — single file analysis |
When to Use the Detector#
Triage scenarios — you have received multiple suspicious files and need to quickly identify which ones warrant deeper investigation. The Detector's batch mode processes up to 50 images simultaneously and exports a CSV with confidence scores for each. Filter on confidence > 0.5 to identify candidates for Analyzer follow-up.
Method identification — you want to know which steganographic technique was used before attempting extraction. The Method Fingerprint tells you whether to look for sequential LSB (most common CTF format), PRNG LSB (requires passphrase for extraction), DCT-based (JPEG steganography), or audio LSB.
Negative confirmation — you need to establish that a file does not contain steganography. The Detector's 0.0–0.3 range provides statistical evidence of absence (within the limits of what statistical tests can detect).
WAV audio detection — the Detector's amplitude distribution analysis for WAV files is more thorough than the Analyzer's audio handling.
When to Use the Analyzer#
Extraction needed — you've identified that steganography is present (either via the Detector or from other evidence) and want to read the hidden content.
Document formats — the Analyzer supports DOCX, PDF, SVG, HTML, and other document formats that the Detector doesn't handle.
Visual bit plane analysis — when statistical scores are ambiguous, the Analyzer's bit plane viewer lets you see structurally whether pixel data has been modified. Structured patterns in bit planes 0–2 confirm LSB embedding even when p-values are borderline.
CTF challenges — the Analyzer is optimized for CTF extraction: it tries multiple encoding configurations automatically, detects flag formats in extracted payloads, and handles AES-256 decryption.
The Two-Tool Forensic Workflow#
For a complete investigation of a suspicious file:
Step 1: Detector
→ Upload file
→ Review Detection Confidence
→ If < 0.3: file is likely clean. Document result.
→ If 0.3–0.6: inconclusive. Proceed to Analyzer for bit plane check.
→ If > 0.6: steganography detected. Note Method Fingerprint.
Step 2: Analyzer (if Detector > 0.3)
→ Upload same file
→ If Detector flagged Sequential LSB: try Auto-Extract
→ If Detector flagged PRNG LSB: enter passphrase candidates, run extraction
→ If Detector flagged DCT: run JPEG DCT analysis mode
→ Review bit planes to visually confirm detection
→ Document extracted payload + entropy analysis
→ Start with the Detector — Steganography Detector
→ Proceed to extraction — Steganography Analyzer
A Real CTF Example#
A CTF challenge provides a 1.2MB PNG called flag.png. It renders as a company logo on a white background.
Detector result:
- Chi-square p-value: 0.61 (moderately suspicious)
- RS confidence: 0.44
- Fusion: 0.55
- Method fingerprint: Sequential LSB (moderate confidence) or Adaptive LSB (low confidence)
Analyzer result:
- Auto-extract: tries Sequential RGB 1-bit first → finds
LSBTEXTheader → decodes payload:flag{1sb_d3t3ct10n_w0rks} - Bit plane 0 (Blue channel): shows structured rectangular pattern in upper-left region confirming embedding location
Without the Detector, you'd still run the Analyzer — but the Detector's method fingerprint told you to try Sequential LSB first, cutting the search time from 10 configurations to 1.
When the Detector Gets It Wrong#
False negative (misses real steganography): PRNG LSB at low payload density (under 5% of capacity) evades chi-square and produces only weak RS signals. The Detector may return 0.2–0.3 for a file that genuinely contains a hidden message. If you have independent reason to believe the file is encoded, skip the Detector and go straight to the Analyzer with known passphrase candidates.
False positive (flags clean file): Medical CT scans, satellite imagery, and heavily post-processed photographs sometimes have natural statistical properties that produce RS ratios above baseline. The Detector returns 0.4–0.6 for files with no hidden content. The bit plane viewer in the Analyzer is the quickest disambiguation — a false positive file's bit planes look like random noise; a true positive shows structured patterns.
Frequently Asked Questions#
If I already know which tool was used to encode the file, should I skip the Detector? Yes — go directly to the Analyzer. The Detector adds value when you don't know whether the file contains steganography or which method was used. If you have that information already, it adds no information and only takes time.
Does the Detector work on screenshots of stego images? Screenshots capture rendered pixel values. If the original stego was LSB-encoded, the screenshot pixel values may differ slightly from the original due to screenshot compression (most screenshots are JPEG or PNG saved at under 100% quality). For PNG screenshots at 100% quality on a lossless display, the stego usually survives. For JPEG screenshots or any screenshot that re-encodes pixels, the stego is likely destroyed and the Detector will return low confidence correctly.
Can I use the Detector to check if my own encoded files are detectable? Yes — this is a primary use case. After encoding with the LSB Embedder, upload the output to the Detector to check your stealth score. The goal for maximum stealth: Fusion < 0.3. If you score above 0.5, reduce payload size, switch from Sequential to PRNG mode, or reduce bit depth.
Does the Detector process files on a server? No — like all StegoToolkit tools, the Detector runs entirely in your browser using a WebWorker. Your images never leave your device. This makes it safe to use on sensitive files where uploading to a third-party server would be a privacy or legal risk.