PNG Chunk / Integrity Analyzer
Parse every chunk in a PNG file — IHDR, IDAT, tEXt, zTXt, ancillary — verify CRC integrity, and expose hidden chunks that common viewers skip entirely.
PNG Chunk Analyzer
Drop a PNG file here or click to browse
PNG only · Max 50 MB · Parsed in your browser
Try a sample file
100% Client-Side Processing
Your PNG is parsed entirely in your browser — CRC-32 validation, zTXt decompression, flag detection, and trailing-data analysis all run locally. Nothing is uploaded or sent anywhere.
What Is a PNG Chunk?
A PNG file is an 8-byte signature followed by a series of chunks. Each chunk has a 4-byte length, a 4-byte type such as IHDR or IDAT, the data, and a 4-byte CRC-32 checksum of the type and data. The file ends with an empty IEND chunk.
Chunks are either critical or ancillary. Critical ones (IHDR for the image header, PLTE for a palette, IDAT for the compressed pixels, IEND for the end) are required to display the image. Ancillary ones such as tEXt, zTXt, iTXt, eXIf and tIME carry optional extras. Whether the first letter of the type is upper or lower case tells you which kind it is.
Where Data Hides in a PNG
Because decoders skip what they do not understand, a PNG can carry more than it shows: text in a tEXt, zTXt or iTXt chunk, a private chunk with an unusual type, bytes appended after IEND, or altered values in IHDR such as a changed width or height. This analyzer lists every chunk and flags each of these cases.
Pixel-level hiding is different: bits hidden in the colour values of the image itself are not visible in the chunk structure. For that, use zsteg or StegSolve.
Why CRC Errors Matter
The CRC protects a chunk's type and data, so changing any byte without recomputing the checksum makes the stored and calculated values differ. Many decoders refuse a file with a bad IHDR CRC, which is why CTF authors sometimes break it on purpose, or why an edited image stops opening.
The analyzer reports both CRC values for each failing chunk, and its CRC Repair panel can rewrite the stored bytes to match without touching the data.
What a Clean Result Does and Does Not Mean
The analyzer checks structure and decodes text chunks. It does not inflate the IDAT pixel data, so a clean report means the chunk layout follows the PNG rules, not that nothing is hidden. Combine it with the Strings Extractor for readable text and the Hex Viewer for raw bytes.
PNG Chunk Type Reference
Common PNG chunk types you will meet in CTF files — what each does, why authors use it, and how hard it is to spot. The tool recognises more types than listed here and flags any it does not know.
| Chunk type | Purpose | CTF relevance | Detection difficulty |
|---|---|---|---|
| IHDR | Image header — dimensions, bit depth, colour type | CRC mismatch = tampered dimensions; common flag-hiding technique | Easy — always first chunk |
| IDAT | Compressed image pixel data (Deflate/zlib) | LSB stego lives here; rarely altered in chunk attacks | Medium — needs pixel decode |
| IEND | End-of-file marker (zero-length) | Data after IEND = hidden payload; ZIP archives common | Easy — scan trailing bytes |
| tEXt | Plain-text key/value pair | Flags embedded in uncompressed text; trivially readable | Easy — plain ASCII |
| zTXt | Deflate-compressed text key/value pair | Same as tEXt but hidden inside compressed data; most tools skip it | Medium — requires decompression |
| iTXt | UTF-8 internationalised text | Flags or base64 payloads; larger capacity than tEXt | Easy — decompression optional |
| PLTE | Colour palette for indexed images | Palette LSB / EZ Stego hides bits in RGB entries | Hard — requires palette analysis |
| tRNS | Transparency data | Can hide data in alpha values of indexed images | Hard — easy to overlook |
| cHRM | Primary chromaticities (colour calibration) | Rarely modified; altered floats signal tampering | Hard — subtle float change |
| gAMA | Image gamma value | Same as cHRM — float LSB manipulation possible | Hard — subtle |
| iCCP | Embedded ICC colour profile | Can embed arbitrary data inside a valid-looking profile | Hard — binary blob |
| bKGD | Background colour hint | Rarely used for hiding; worth checking in forensic mode | Medium |
| acTL | APNG animation control (frame count, loops) | Present = animated PNG; multiple frames = per-frame stego possible | Medium — flag APNG files |
| fcTL | APNG frame control (dimensions, delay) | Delays / offsets can encode data; check anomalous values | Hard |
| fdAT | APNG frame pixel data | Same attack surface as IDAT for each frame | Hard |
How to use this tool (6 steps)
- Upload a PNG file (or try a sample below)
- Review the Findings Summary — any errors or suspicious findings?
- Check IHDR CRC errors — dimensions may have been tampered
- Read all zTXt / tEXt / iTXt content — flags often live here
- Download any data found after IEND — may be a ZIP or another image
- If all clear: run zsteg or StegSolve for pixel-level analysis
How the PNG Chunk Analyzer works
1. Signature and chunk walk
The parser checks the 8-byte PNG signature (89 50 4E 47 0D 0A 1A 0A), then reads chunks in order: a 4-byte big-endian length, a 4-byte type, the data, and a 4-byte CRC. Parsing stops at the first IEND chunk.
2. CRC-32 validation
For every chunk, the tool computes CRC-32 (polynomial 0xEDB88320) over the type and data bytes and compares it with the stored value. A mismatch is reported with both values, and the CRC Repair panel can rewrite the stored bytes to match without touching the data.
3. Structure checks
IHDR must be first, exactly 13 bytes, with a valid colour type and bit-depth pairing. IHDR and IEND must appear once, IDAT must exist, IDAT chunks should be consecutive, indexed images need PLTE, and IEND must be empty. Unknown critical chunks and large private chunks are flagged.
4. Text and metadata decoding
tEXt is read as Latin-1, iTXt as UTF-8. zTXt (and compressed iTXt) is inflated with the browser DecompressionStream, falling back to raw deflate for non-standard encoders. Decoded text is scanned for flag{...}, ctf{...}, htb{...}, picoctf{...}, thm{...} patterns and MD5/SHA-256-length hex strings.
5. Trailing data
Bytes after the end of the IEND chunk are outside the PNG specification. The tool reports their offset and length, guesses the format from magic bytes (ZIP, PNG, JPEG, PDF, GIF, RAR, 7-Zip, ELF) and offers a download.
What the results mean
| Severity | Triggered by | What to do |
|---|---|---|
| Error | A rule in the PNG specification is broken: CRC mismatch, missing IHDR/IEND/IDAT, invalid IHDR values, truncated file, non-empty IEND, or an unknown critical chunk. | The file was edited, corrupted or crafted. Check IHDR first — altered dimensions are a common CTF trick. |
| Suspicious | Structurally valid, but something is where it should not be: bytes after IEND, or a private chunk over 10 KB. | Likely a hidden payload. Download the trailing data or inspect the chunk in the hex view. |
| Warning | Unusual but not invalid: non-consecutive IDAT, PLTE on a non-indexed image, unknown public chunk, raw-deflate zTXt, failed decompression. | Worth a look; often produced by non-standard tools rather than hiding. |
| Finding | A CTF flag pattern matched inside decoded text content. | Verify the match manually — the pattern is a regular expression, not proof of intent. |
| Info | Neutral facts: IDAT count and size, private ancillary chunks, APNG chunks. | Context for the other results. |
Examples
Input: PNG with a zTXt chunk (keyword Comment) containing compressed text
Result: zTXt chunk shows the decompressed text; a Finding reports flag{...} if the pattern matches.
Meaning: The flag was stored compressed, so tools that only list chunk sizes never showed it.
Input: PNG whose IHDR height was changed without recalculating the CRC
Result: Error: IHDR CRC mismatch with stored and computed values, plus the decoded width and height.
Meaning: Dimensions were tampered with. Use CRC Repair, or try larger heights until the image renders fully.
Input: PNG with a ZIP archive appended after IEND
Result: Suspicious: N bytes after IEND; first bytes match ZIP archive (PK signature); download offered.
Meaning: Viewers ignore the extra bytes, so the archive is invisible until you extract it.
Input: A PNG whose width or height was edited in a hex editor, with the IHDR CRC left unchanged
Result: An Error on the IHDR chunk showing the stored CRC and the calculated one.
Meaning: The header was modified after the checksum was written. The CRC Repair panel can recompute it so decoders accept the file again.
Input: A tEXt chunk with the keyword Comment whose text is ZmxhZ3tiYXNlNjR9 (base64)
Result: The chunk is listed and its text shown, but no flag finding is raised.
Meaning: The scanner matches readable flag patterns only; encoded text is shown but not decoded. Decode the base64 yourself, which here gives flag{base64}.
Limitations
- IDAT data is not inflated or unfiltered, so this tool does not check the zlib stream or read pixels. Pixel-level hiding (LSB, palette) needs zsteg or StegSolve.
- Parsing stops at the first IEND. Chunks or images after it appear only as trailing data.
- Decompressed zTXt/iTXt output is capped at 1 MB and displayed up to 50 KB.
- Flag detection is regex-based: it finds common formats (flag, ctf, htb, picoctf, thm) and hash-length hex strings, not encoded or encrypted flags.
- The batch scanner reads up to 20 files at once.
- It reports structure. A clean result does not prove a PNG has no hidden data.
Privacy
Your PNG is read and parsed in a Web Worker in your browser and is not uploaded. After analysis, a copy of the file and its findings is kept in IndexedDB in this browser so the Hex Viewer can open it without a re-upload. It stays on your device and is not sent to a server. The Hex Viewer treats saved data as expired after 30 minutes.
Frequently Asked Questions
What is a PNG chunk?▾
What does a CRC mismatch mean?▾
What is a zTXt chunk and why can't most tools read it?▾
What does 'data after IEND' mean?▾
This tool says the PNG is clean — what do I try next?▾
Is my file uploaded anywhere?▾
What is the equivalent command-line tool?▾
How do I check the CRC of a PNG file?▾
Can this tool repair a PNG with bad CRCs?▾
Does it support animated PNG (APNG)?▾
Can it prove a PNG has no hidden data?▾
Related Tools
File Type / Magic Byte Detector
Confirm a file is really a PNG before analysing it.
Strings Analyzer
Search the whole file for readable text and flags.
Encoding Auto-Decoder
Decode tEXt / zTXt chunk data that looks like Base64 or hex.
ROT13 & Caesar Cipher Solver
tEXt chunk text that looks like ROT13 or a Caesar shift? Solve it.
Hex Viewer / Editor
Look at the raw bytes around a suspicious chunk.
Steganography Analyzer
Statistical pixel-level checks when the structure is clean.