Audio Steganography Extractor
Extract hidden text or files from WAV or MP3 audio. Auto-detect all algorithms, AES-256 decryption, CTF flag highlighting. 100% client-side.
Drop a WAV or MP3 file here or click to browse
PCM WAV (8/16/24/32-bit) · MP3 (auto-converted) · Max 500 MB
MP3 files are decoded to PCM locally via Web Audio API
100% Client-Side Processing
Your audio is processed entirely in this browser tab. Nothing is uploaded. MP3 files are decoded to PCM locally via the Web Audio API.
How to Extract a Hidden Message from Audio (4 steps)
- Upload the WAV or MP3 file you suspect contains hidden data
- Pick a mode: Quick (one click) → Standard (choose bit depth) → Forensic (raw analysis)
- Enter a password if the payload was encrypted with the encoder
- Click Decode — the extracted message, file, or hex dump appears below
Audio Steganography Decoding — What This Tool Handles
| Method | Technique | When to Use | Best For |
|---|---|---|---|
| LSB 1-bit | Least significant bit per sample | Most common — try first | CTF flags, short text |
| LSB 2–4 bit | Multiple low bits per sample | Higher capacity, audible noise risk | Larger payloads |
| Channel split | Left or right channel only | Stealthy stereo encoding | Avoiding mono extraction |
| AES-256-GCM | Decrypts an encrypted payload | Required when entropy is high | Encrypted messages |
| Magic-byte detect | Identifies extracted file types | PDF, ZIP, PNG, MP3, ELF, EXE | Hidden files |
Frequently Asked Questions
What audio formats does the decoder support?
PCM WAV (8/16/24-bit) and MP3. MP3 files are automatically transcoded to WAV in your browser via ffmpeg.wasm before extraction — nothing is uploaded.
Is my audio file uploaded to a server?
Never. All decoding happens in your browser. The audio file never leaves your device.
The output looks like garbage. What do I do?
Check the entropy meter. High entropy (>7.4) usually means the payload is encrypted — enter the password used by the encoder. Otherwise try a different bit depth or channel.
Can I extract files, not just text?
Yes. Magic bytes are auto-detected for PDF, ZIP, PNG, JPEG, GIF, MP3, ELF, and EXE — you'll get a download button with the right extension.
What is auto-detect mode?
Tries all LSB configurations (bit depth 1–4, both channels, left/right, MSB order) plus Echo Hiding, Phase Coding, and Spread Spectrum — over 10 attempts total. Shows a ranked results table so you can see every attempt.
Will it find a hidden CTF flag automatically?
Yes. Output is scanned for FLAG{}, HTB{}, picoCTF{}, CTF{}, and CHTB{} patterns and any hits are highlighted at the top.
Which algorithms does the decoder support?
LSB (1–4 bit, all channels and bit orders), Echo Hiding, Phase Coding, and Spread Spectrum — all four encoding algorithms are supported. Auto-detect tries all configurations automatically.