Color Channel Steganography Extractor
Extract hidden data from a color channel of a PNG or BMP. COLSTEG auto-detect, bit plane viewer, 32-combination brute-force, CTF flag detector.
Try the demo instantly
Loads a stego PNG with a hidden message already embedded — auto-decodes instantly
Drop PNG or BMP here, or click to browse
JPEG not supported — lossy compression destroys LSB data
100% Client-Side Processing
Your image is processed entirely in this browser tab. Nothing is uploaded to any server.
How to Decode Color Channel Steganography (5 steps)
- Upload the PNG or BMP image you want to check
- Click Auto Decode — if encoded with the companion encoder, it extracts automatically
- If no COLSTEG header: use Brute-Force to try all channels
- Enter passphrase if the payload was encrypted
- Copy the text or download the hidden file
Frequently Asked Questions
What's the difference between this and stegonline?
stegonline is a visualisation tool — it shows you what each bit plane looks like as an image. It cannot extract a payload and download it. This tool does both: renders the same kind of per-channel bit plane view and extracts the actual hidden payload as copyable text or a downloadable file.
What does the bit plane viewer show?
Each pixel's colour value is an 8-bit number (0–255). Bit plane 0 shows only the least significant bit of each pixel in a channel. If data is hidden in LSBs, the bit plane renders as a structured black/white image instead of random noise.
How does the flag detector work?
After extracting the payload, the tool scans the decoded bytes for common CTF flag formats using regex patterns: flag{...}, CTF{...}, HTB{...}, THM{...}, picoCTF{...}, DUCTF{...}. A match is highlighted prominently with a one-click copy button.
My brute-force found a result but it looks like garbage — why?
Most likely the payload was AES-256-GCM encrypted. Enter the passphrase used during encoding and try again. Alternatively, the image may use a non-standard encoding not covered by the 32 brute-force combinations.
How does auto-detect work?
Auto-detect scans all 4 channels (Blue, Red, Alpha, Green — in that priority order) for a valid COLSTEG v1 header, validating the CRC32 checksum. If found, the mode, channels, bit depth, and encryption flag are all read from the header — zero configuration required.
What if there's no COLSTEG header?
The image may have been encoded by a different tool, edited after encoding, or genuinely has no hidden data. Switch to Forensic mode and try Brute-Force (32 combinations) or the Bit Plane Viewer to look for structured patterns manually.