StegoToolkit

File Hider Extractor

Extract hidden files from polyglot carriers. Browser-based binwalk alternative with auto-detect, AES decryption, and visual hex map.

Drop carrier file or click to browse

JPEG, PNG, MP3, PDF, or any file (max 500MB)

Try the demo instantly — no upload needed

Loads a pre-encoded PNG with hello.txt hidden inside.

jpeg

png

mp3

pdf

How to Extract Hidden Files (4 steps)

  1. Upload a carrier file you suspect contains a hidden payload
  2. Optionally enter the encryption password
  3. Click Decode — the tool scans for the EP_STEGO marker and extracts what's inside
  4. Download the recovered file (or unzip the bundled archive)

File Extraction Methods — What This Tool Detects

MethodTechniqueAdvantageBest For
EOF AppendAdds payload after the carrier's natural end-of-file markerCarrier opens normally in any viewer · unlimited capacityDefault — JPEG/PNG/MP3/PDF/anything
PNG Chunk Injection (stEG)Inserts payload as a custom 'stEG' chunk before IEND with a valid CRC32Survives some PNG re-saves · invisible to file-size checksHardened CTF challenges, archival images
Multi-file ZIPJSZip-bundles multiple input files before embeddingSame wire format · transparent to the userHiding 2+ files at once
AES-256-GCMEncrypts the payload before appendingWrong password silently rejected · plausible deniabilityEncrypted exfil / CTF challenges
Reed-Solomon RedundancyWraps the payload in shard-based redundancy (RS-10/20/30)Survives 10–30% trailing-data corruptionUnreliable transfer / archival storage
EP_STEGO marker8-byte magic header + 1B flags + 4B BE lengthDecoder auto-locates and extractsRound-trip with this decoder

Frequently Asked Questions

What does this decoder look for?

It scans the file for the EP_STEGO marker the encoder writes, reads the flags + length, and extracts the payload. It also detects PNG stEG chunks and unwraps Reed-Solomon redundancy when present.

What if no marker is found?

Either the file is clean, or it was hidden with a different tool. Try a different decoder for tools like binwalk-style polyglots that use no marker.

What if the payload looks like noise?

It's probably encrypted. Enter the password used during encoding and try again — wrong passwords return garbage rather than an error.

Does this support multi-file payloads?

Yes. If the encoder bundled multiple files into a ZIP, the decoder unpacks them automatically and lets you download each one.

Is anything uploaded?

No. Decoding is 100% local using ArrayBuffer scanning, JSZip, and the Web Crypto API.