StegSolve Online — CTF Image Analysis Without Java

StegSolve is the tool every CTF writeup mentions for image steganography — but it's a Java .jar file last updated in 2015, and it breaks on every modern Java version. StegSolve Online replaces it entirely: same bit planes, same data extraction controls, same image combiner — running locally in your browser with no Java, no download, and no setup.

→ Open StegSolve Online — start analyzing in seconds

What StegSolve Does (and Why CTF Players Need It)#

Image steganography challenges hide flags in places that are invisible to normal image viewers:

• Bit planes — the least significant bits of individual colour channels contain patterns or readable text that only appear when isolated
• Appended data — files hidden after the PNG IEND marker or JPEG EOF
• PNG text chunks — tEXt, zTXt, or custom chunk types with encoded data
• GIF frames — flags hidden in specific animation frames
• Combined images — XOR or AND of two images reveals concealed content

StegSolve.jar was the tool that handled all of these in one interface. The problem is that it requires exactly Java 8 to function correctly. On Java 11, 17, or 21 — which most systems ship — it either refuses to launch or renders a blank window.

StegSolve Online implements every original feature plus significant additions, and runs entirely client-side. Your image never leaves your device.

Core Features: StegSolve Compatibility#

Bit Planes — All 28, Viewable Immediately#

The primary StegSolve feature. The tool renders every bit plane of an image as a black-and-white view:

Red channel:    R0 (LSB) → R7 (MSB)   (8 planes)
Green channel:  G0       → G7          (8 planes)
Blue channel:   B0       → B7          (8 planes)
Alpha channel:  A0       → A7          (8 planes)
Total:          28 planes

Grid view shows all 28 simultaneously as thumbnails — the biggest usability improvement over the original, which forces clicking through planes one at a time. A suspicious plane with hidden text or patterns stands out immediately in grid view without cycling through all 28 manually.

Single view matches the original StegSolve exactly: left/right arrow keys cycle through planes. Includes pixel-perfect zoom (1×, 2×, 4×, 8×, 16×) — essential for small CTF challenge images.

Suspicious planes are highlighted automatically: a flag border when flag patterns are found, orange when chi-square is elevated.

Data Extraction — Identical Controls to the Original#

The extraction panel matches StegSolve's layout:

         Bit7  Bit6  Bit5  Bit4  Bit3  Bit2  Bit1  Bit0
Red        ☐     ☐     ☐     ☐     ☐     ☐     ☐    [☑]
Green      ☐     ☐     ☐     ☐     ☐     ☐     ☐    [☑]
Blue       ☐     ☐     ☐     ☐     ☐     ☐     ☐    [☑]
Alpha      ☐     ☐     ☐     ☐     ☐     ☐     ☐     ☐

Order:  ● Row  ○ Column
First:  ● MSB  ○ LSB

Default settings (R0+G0+B0, Row, MSB) match StegSolve's defaults exactly. The extracted byte stream is identical to what the original produces.

Image Combiner#

Upload two images and combine with XOR, AND, OR, ADD, SUB, or XOR+1 — the same six operations in the original. Side-by-side preview shows both inputs and the result. Cycle through all six operations with arrow keys. Download each combination.

Frame Browser and Stereogram Solver#

GIF frame browser works as in the original: step through frames, view durations, extract individual frames as PNG, or export all frames as a ZIP. The stereogram solver provides an offset slider to reveal hidden 3D patterns.

What StegSolve Online Adds#

Auto-Scan on Upload#

As soon as you upload an image, a background scan runs and produces a findings card:

• Chi-square LSB detection per channel (flags elevated statistics indicating embedded data)
• Shannon entropy per channel
• Automatic flag pattern search across all 28 planes (flag{...}, HTB{...}, picoCTF{...}, DUCTF{...}, CTF{...})
• QR code detection on each plane using jsQR
• Extra bytes after IEND (PNG)
• Non-standard PNG chunks (tEXt, zTXt, unknown chunk types)
• EOF detection (appended data after formal file end)

The auto-scan gives you a result before you've clicked anything. For most CTF challenges, the answer is in the card.

Brute-Force Channel Combinator#

The biggest practical improvement over the original. Instead of manually trying different channel combinations, the brute-force scanner tests all 200+ configurations automatically:

• Every channel combination (R, G, B, A; pairs; triples; all four)
• Row-by-row and column-by-column scan order
• MSB-first and LSB-first byte order

Each result is scored by readability (percentage of printable ASCII characters). Results with flag patterns are highlighted. The full scan takes 1–2 seconds in a WebWorker — the UI never blocks.

This makes StegSolve Online a browser-native hybrid of the original (visual) + zsteg (automated scanning).

Auto-Decode#

Extracted bytes are automatically checked for base64, hex encoding, and ROT13. If a match is found, the decoded result appears immediately below the raw output — you don't need to open a separate decoder.

PNG Chunk Analysis#

A dedicated tab shows all PNG chunks with their types, sizes, and offsets. tEXt, zTXt, and iTXt chunks are decoded and displayed. Non-standard chunk types are flagged with their hex content. Extra bytes after IEND are shown in a hex viewer with extract button.

CLI Equivalents#

For every extraction configuration you set, the tool shows the equivalent zsteg command. Useful for writeups and for verifying results against the command-line tool.

CTF Workflow: How to Use It#

For any image challenge, start here:

1. Upload the image — auto-scan runs immediately. Read the findings.
2. If chi-square is elevated on a specific channel (e.g., G0): go to Extract, select that channel, click Extract.
3. If auto-scan shows nothing specific: click Brute-Force — it finds readable combinations in seconds.
4. Open Bit Planes → Grid View. Look for planes with text, patterns, or QR codes.
5. Check Chunks for PNG metadata (tEXt, non-standard chunks, appended bytes).
6. For GIF: open Frames, step through, or scan all frames.
7. For two-image challenges: go to Combine, upload the second image, try XOR first.

The CTF Checklist panel tracks which steps you've completed and lets you export the checklist as Markdown for your writeup.

Privacy and Security#

Everything runs locally. No files, pixel data, or analysis results are sent to any server. The tool works without an internet connection after the initial page load.

This is relevant for CTF environments where you may be analyzing challenge files on a restricted network, or for security researchers working with sensitive images.

Quick Comparison#

| Feature | StegSolve.jar | StegSolve Online | |---|---|---| | Requires Java | ✅ Java 8 only | ❌ No Java | | Bit planes (28) | ✅ | ✅ | | Grid view (all planes) | ❌ One at a time | ✅ All simultaneous | | Data extraction | ✅ | ✅ Identical controls | | Image combiner | ✅ | ✅ | | GIF frames | ✅ | ✅ | | Stereogram solver | ✅ | ✅ | | Chi-square detection | ❌ | ✅ | | Brute-force scanner | ❌ | ✅ 200+ combinations | | Auto flag detection | ❌ | ✅ | | PNG chunk analysis | ❌ | ✅ | | Pixel zoom | ❌ | ✅ 1×–16× | | CLI equivalents | ❌ | ✅ | | Offline PWA | ❌ | ✅ | | Works on modern systems | ❌ Frequently broken | ✅ |

→ Open StegSolve Online — no install needed

For statistical steganography detection without visual analysis, the Steganography Analyzer runs chi-square, RS Analysis, Sample Pairs, and Primary Sets against any image and produces a forensic report.

For extracting a specific LSB payload from an image where you know the parameters, the Image Steganography Extractor provides a focused single-step interface.