Binary Steganography Hider
Hide text or files inside any binary file — EXE, DLL, ZIP, JAR, ISO, firmware — using EOF appending, null cavity injection, PE section appending, or ZIP comment field. AES-256 encrypted.
Try the demo instantly
Loads a sample EXE — shows all applicable methods
Drop any binary file here or click to browse
EXE · DLL · ZIP · JAR · APK · ISO · firmware · Max 50 MB
100% Client-Side Processing
Your file is processed entirely in this browser tab. Nothing is uploaded to any server. Works offline after page load.
How to Hide Data in a Binary File (5 steps)
- Upload any binary file — EXE, DLL, ZIP, JAR, ISO, or raw binary
- Type your secret message or upload a file to hide
- Choose a hiding method (auto-selected for your file type)
- Add a passphrase to encrypt the payload (recommended)
- Click Encode — download your stego binary
4 Hiding Methods Compared
| Method | Technique | Capacity | Best For |
|---|---|---|---|
| EOF Appending | Payload appended after the last byte the format parser reads | Unlimited | Any binary file — CTF challenges, quick testing, maximum payload size |
| Null Cavity Injection | Hidden in runs of consecutive null-byte padding within the file body | ~1–50 KB (depends on carrier) | EXE/DLL/firmware — lower detection risk than EOF |
| PE Section Appending | New hidden section added to the Windows PE section table | Several MB | .exe/.dll files — experimental, may trigger AV heuristics |
| ZIP Comment Field | Payload stored in the ZIP end-of-central-directory comment | Up to 65,535 bytes | .zip/.jar/.apk/.docx/.xlsx/.pptx |
| ELF Section Appending | New hidden section added to the ELF section header table | Several MB | Linux binaries — equivalent of PE Section |
| Raw Offset Injection | Overwrites a specific byte offset with the payload | Unlimited (bounded by file size) | Firmware/raw binaries with a known unused region |
| PDF Stream Injection | A real, unreferenced stream object added via a PDF incremental update | Unlimited | PDF documents with a classic (non-cross-reference-stream) trailer |
Frequently Asked Questions
Does the carrier file still work after encoding?
Yes for all methods. EOF-appended data is ignored by EXE loaders, ZIP extractors, and all format parsers — they stop reading before the appended bytes. Null cavity injection replaces null padding bytes that are never read. PE/ELF section appending adds a section the loader ignores. ZIP comment and PDF stream injection are never rendered or executed.
What is binwalk and can it detect this?
binwalk is a binary analysis CLI tool used in CTF and forensics to scan files for embedded data. It finds EOF-appended data quickly. Null cavity, PE/ELF section, and ZIP comment methods have lower location-detection profiles. Even if location is found, AES-256-GCM encryption means the content is unreadable without the passphrase.
Which method should I use for a ZIP file?
Use ZIP Comment Field for ZIP archives (including .jar, .apk, .docx, .xlsx). It stores up to 64 KB in the EOCD comment — a standard field most extractors ignore. For more than 64 KB, use EOF Appending.
Does re-zipping a ZIP archive destroy the hidden data?
Yes. If the ZIP is opened and re-saved, both EOF-appended data and the ZIP comment field are typically discarded on repack. Transfer the file as-is. The same applies to EXE files: re-compiling, stripping, or re-linking destroys all embedded data.
Can I hide an executable inside another executable?
Yes. Any file type can be the payload, including executables. The payload is read as binary bytes, optionally encrypted with AES-256-GCM, and embedded in the carrier. The carrier's runtime behavior is unaffected.
Is PE/ELF Section Appending safe to use?
It's genuinely experimental — the tool re-parses and validates the output after encoding, and automatically falls back to EOF Appending if validation fails, so you never get a silently-broken binary. For most use cases, Null Cavity or EOF is safer.