File Hider Extractor
Extract hidden files from polyglot carriers. Browser-based binwalk alternative with auto-detect, AES decryption, and visual hex map.
Drop carrier file or click to browse
JPEG, PNG, MP3, PDF, or any file (max 500MB)
Try the demo instantly — no upload needed
Loads a pre-encoded PNG with hello.txt hidden inside.
jpeg
png
mp3
How to Extract Hidden Files (4 steps)
- Upload a carrier file you suspect contains a hidden payload
- Optionally enter the encryption password
- Click Decode — the tool scans for the EP_STEGO marker and extracts what's inside
- Download the recovered file (or unzip the bundled archive)
File Extraction Methods — What This Tool Detects
| Method | Technique | Advantage | Best For |
|---|---|---|---|
| EOF Append | Adds payload after the carrier's natural end-of-file marker | Carrier opens normally in any viewer · unlimited capacity | Default — JPEG/PNG/MP3/PDF/anything |
| PNG Chunk Injection (stEG) | Inserts payload as a custom 'stEG' chunk before IEND with a valid CRC32 | Survives some PNG re-saves · invisible to file-size checks | Hardened CTF challenges, archival images |
| Multi-file ZIP | JSZip-bundles multiple input files before embedding | Same wire format · transparent to the user | Hiding 2+ files at once |
| AES-256-GCM | Encrypts the payload before appending | Wrong password silently rejected · plausible deniability | Encrypted exfil / CTF challenges |
| Reed-Solomon Redundancy | Wraps the payload in shard-based redundancy (RS-10/20/30) | Survives 10–30% trailing-data corruption | Unreliable transfer / archival storage |
| EP_STEGO marker | 8-byte magic header + 1B flags + 4B BE length | Decoder auto-locates and extracts | Round-trip with this decoder |
Frequently Asked Questions
What does this decoder look for?
It scans the file for the EP_STEGO marker the encoder writes, reads the flags + length, and extracts the payload. It also detects PNG stEG chunks and unwraps Reed-Solomon redundancy when present.
What if no marker is found?
Either the file is clean, or it was hidden with a different tool. Try a different decoder for tools like binwalk-style polyglots that use no marker.
What if the payload looks like noise?
It's probably encrypted. Enter the password used during encoding and try again — wrong passwords return garbage rather than an error.
Does this support multi-file payloads?
Yes. If the encoder bundled multiple files into a ZIP, the decoder unpacks them automatically and lets you download each one.
Is anything uploaded?
No. Decoding is 100% local using ArrayBuffer scanning, JSZip, and the Web Crypto API.