StegoToolkit

Color Channel Steganography Extractor

Extract hidden data from a color channel of a PNG or BMP. COLSTEG auto-detect, bit plane viewer, 32-combination brute-force, CTF flag detector.

Auto-detect
Brute-Force

Try the demo instantly

Loads a stego PNG with a hidden message already embedded — auto-decodes instantly

Drop PNG or BMP here, or click to browse

JPEG not supported — lossy compression destroys LSB data

100% Client-Side Processing

Your image is processed entirely in this browser tab. Nothing is uploaded to any server.

How to Decode Color Channel Steganography (5 steps)

  1. Upload the PNG or BMP image you want to check
  2. Click Auto Decode — if encoded with the companion encoder, it extracts automatically
  3. If no COLSTEG header: use Brute-Force to try all channels
  4. Enter passphrase if the payload was encrypted
  5. Copy the text or download the hidden file

Frequently Asked Questions

What's the difference between this and stegonline?

stegonline is a visualisation tool — it shows you what each bit plane looks like as an image. It cannot extract a payload and download it. This tool does both: renders the same kind of per-channel bit plane view and extracts the actual hidden payload as copyable text or a downloadable file.

What does the bit plane viewer show?

Each pixel's colour value is an 8-bit number (0–255). Bit plane 0 shows only the least significant bit of each pixel in a channel. If data is hidden in LSBs, the bit plane renders as a structured black/white image instead of random noise.

How does the flag detector work?

After extracting the payload, the tool scans the decoded bytes for common CTF flag formats using regex patterns: flag{...}, CTF{...}, HTB{...}, THM{...}, picoCTF{...}, DUCTF{...}. A match is highlighted prominently with a one-click copy button.

My brute-force found a result but it looks like garbage — why?

Most likely the payload was AES-256-GCM encrypted. Enter the passphrase used during encoding and try again. Alternatively, the image may use a non-standard encoding not covered by the 32 brute-force combinations.

How does auto-detect work?

Auto-detect scans all 4 channels (Blue, Red, Alpha, Green — in that priority order) for a valid COLSTEG v1 header, validating the CRC32 checksum. If found, the mode, channels, bit depth, and encryption flag are all read from the header — zero configuration required.

What if there's no COLSTEG header?

The image may have been encoded by a different tool, edited after encoding, or genuinely has no hidden data. Switch to Forensic mode and try Brute-Force (32 combinations) or the Bit Plane Viewer to look for structured patterns manually.