Image-in-Image Extractor
Extract hidden images made by the Image-in-Image Hider. Auto-Detect tries 12 configurations (4 bit depths × 3 channels). Bit plane viewer, optional AES-256 password, JSON report.
Try the demo instantly
Loads a 200×200 gradient PNG — no upload needed
Drop image file or click to browse
PNG, BMP, WebP, JPEG — max 50 MB (10 MB on mobile). TIFF opens only in browsers that can decode it (Safari)
Processed in your browser
Your image is decoded in your browser, in a Web Worker, and is not sent to a StegoToolkit server. Basic usage analytics record coarse facts such as file type and size range, never the image or your payload. Output is always a lossless PNG.
How to Extract a Hidden Image from a Photo (4 steps)
- Upload the PNG that may contain a hidden image (a lossless copy of the file the Hider produced)
- Choose Quick for Auto-Detect, or Standard / Forensic to set the bit depth and channels yourself
- Enter the password if the hidden image was encrypted
- Click Extract Hidden Image, view the recovered picture and download it
Image-in-Image Decoder — Detection & Extraction Methods
| Method | Technique | Speed | Best For |
|---|---|---|---|
| Auto-Detect | Tries all 12 combinations (1 to 4 bits × Blue, Red + Blue, Red + Green + Blue) and keeps the ones that give a valid header | Finds files made with this tool's layout | Default |
| Manual (Standard / Forensic) | Reads one chosen bit depth and channel combination | Needs the exact settings | A file you know was made with custom settings |
| Password | Decrypts the secret's pixels with AES-256-GCM | A wrong password gives an error | Encrypted hidden images |
What the Extractor Reads
This Extractor reads images hidden by the Image-in-Image Hider. It reads bits from the lowest bits of the chosen channels, expects a 4-byte length followed by the secret's width, height and an encrypted flag, and accepts the result only if that header makes sense. It does not read hidden images made by other tools, which use their own layouts.
For a file from another tool, try the LSB Extractor with manual settings, or the Steganography Analyzer, which shows the bit planes.
What Auto-Detect Does
Auto-Detect tries all 12 combinations of bit depth (1 to 4) and channels (Blue, Red + Blue, Red + Green + Blue). For each one it checks that the length and the secret's size are plausible and that enough data follows. In our tests on a 160 × 120 test cover, exactly one of the 12 gave a valid image for a file made with each combination, and none did for a clean image. The rows that failed are listed with the reason (no payload, invalid header, wrong password).
If several rows give an image, the one that looks most like a picture (more variation and edges) is shown first; you can click another row.
Passwords
If the hidden image was encrypted, the Extractor needs the same password. Without one, it tells you that an encrypted hidden image was found and shows its size, because the header is not encrypted. With a wrong password it says "Wrong password".
The password is turned into a key with PBKDF2-HMAC-SHA-256 (100,000 iterations) and the salt stored in the payload, and the AES-256-GCM authentication tag then checks it. A wrong password and a damaged payload both simply report failure, so the tool cannot tell you which it was, and there is no way to recover a forgotten password. The full description, including what this scheme does not protect, is on the Image-in-Image Hider page.
The LSB-Balance Numbers Are Only a Hint
The page shows, per channel, the share of pixels whose lowest bit is 1. Most photos and most stego images both sit near 0.5, so these numbers cannot tell a clean image from one with a hidden picture: in our test a clean image measured 0.476 / 0.501 / 0.500 and the same image with a hidden picture 0.509 / 0.467 / 0.507. Trust the Auto-Detect result, not these numbers. A match means a payload in this tool's format was found; it is a match on the header, not proof of anything beyond that.
What Happens in Common Cases
| The file is | Result |
|---|---|
| A PNG made by the Hider, no password | The hidden image is recovered pixel for pixel |
| A PNG made by the Hider with a password, no password entered | An encrypted hidden image is reported, with its size; no picture is shown |
| The same file, wrong password | "Wrong password" error |
| The same file, right password | The hidden image is recovered pixel for pixel |
| A clean image | No hidden image found in any of the 12 combinations |
| A stego PNG that was re-saved, resized or converted to JPEG | Usually nothing is found: the changes to the pixels are gone |
| A hidden image made by another tool | Usually nothing is found |
Examples
Input: A 200 × 150 PNG made by the Hider in Recommended mode with a 40 × 30 secret
Result: Auto-Detect finds one valid combination (2-bit, Red + Green + Blue) and shows the 40 × 30 image
Meaning: The other 11 combinations are listed as no payload or invalid header.
Input: The same file made with a password, extracted with no password
Result: "Encrypted hidden image detected", with the size of the hidden image and no picture
Meaning: The header is readable, the pixels are not. Enter the password and extract again.
Input: A clean 200 × 150 PNG
Result: No hidden image found
Meaning: None of the 12 combinations gave a valid header.
How the Extractor Works
1. Read the image
The PNG is drawn onto a canvas and read as colour values.
2. Try a combination
For one bit depth and channel set, the bits are read most significant bit first from the lowest bits of each value, pixel after pixel.
3. Check the header
The first 4 bytes are a length; then comes the secret's width, height and an encrypted flag. Sizes that are zero or too large (over 16,384 per side) are rejected.
4. Decrypt
If the flag says encrypted, the pixels are decrypted with your password (AES-256-GCM); a wrong password fails the authentication.
5. Show
The red, green and blue bytes become the recovered picture, which you can download as a PNG.
What the results mean
| Result | What it means | What to do |
|---|---|---|
| Recovered Secret Image | A valid header and enough data were found; the picture is shown | Download it |
| Encrypted hidden image detected | A valid header says the pixels are encrypted | Enter the password and extract again |
| Wrong password | The decryption check failed | Check the password; a damaged file gives the same message |
| No hidden image found | None of the 12 combinations gave a valid header | Check that you have the original PNG, not a re-saved or resized copy |
| Row: invalid header / no payload | That combination did not produce a usable header | Normal for most of the 12 rows |
Limitations
- Only images hidden by this tool's Hider are read. Other tools use other layouts.
- A stego PNG that was re-saved, resized or converted to JPEG usually loses the hidden image. We have not tested individual websites or apps.
- The recovered picture has no transparency: it was stored as red, green and blue only. In Chromium, pixels that were fully transparent in the secret come back black.
- The LSB-balance numbers are a weak hint and cannot tell a clean image from a stego one.
- The secret's width and height are each limited to 16,384 pixels.
Privacy
Your image and password are processed in your browser, in a Web Worker, and are not sent to a StegoToolkit upload server. The image-processing code does not transmit your image or the recovered picture. Separate site analytics may send limited usage events (the options you choose such as the mode, the file's type and a size range, and how long processing took): page views are counted by Vercel Analytics, which is cookieless, and tool events go to Google Analytics only if the site has it configured and you accepted analytics cookies. Those events do not include your image, the recovered picture, a password or the filename. If you accept cookies, the site may also load advertising and other analytics scripts that are not part of this tool. Your display mode preference is kept in this browser's localStorage.
Which Tool Next?
- Image-in-Image Hider — Hide an image inside another image
- Image Steganography Extractor — Extract text or files hidden in images
- LSB Extractor — Read LSB data with settings you choose
- Steganography Detector — Test whether an image shows signs of hidden data
- Steganography Analyzer — Look at the bit planes of any image
Frequently Asked Questions
How do I know if an image contains a hidden image?
Run Auto-Detect. If one of the 12 combinations gives a valid header and a picture, a hidden image in this tool's format is present (a header match, which a coincidence could in principle produce, though none did in our tests). The LSB-balance numbers cannot tell you: a clean image and a stego image both sit near 0.5.
Auto-Detect says no hidden image was found. What should I do?
Make sure you have the original PNG, not a copy that was re-saved, resized or converted to JPEG. If the image came from another tool, this Extractor cannot read it; try the LSB Extractor with manual settings or the Steganography Analyzer.
The recovered picture looks like noise. Is it encrypted?
If the hidden image was encrypted and you entered the wrong password, the tool shows an error, not noise. A noisy picture usually means Auto-Detect picked a row that is not the right one: click the other rows in the grid.
Do I need to know the bit depth and channels?
No. Auto-Detect tries all 12 combinations and shows the ones that give a valid header. You only need Manual mode to read a file you know used a specific setting.
Can it read images hidden by another image-in-image tool?
Not reliably. This Extractor expects the Hider's layout: a 4-byte length, the secret's size and an encrypted flag, then the colour bytes. Other tools use other layouts. For those, try the LSB Extractor with manual settings.
Is my image uploaded anywhere?
No. The image is processed in your browser and is not sent to a StegoToolkit server. Coarse usage facts may be counted if you accept analytics; the image and password are never included.
What do the bit planes show?
Each bit plane is one bit of one colour channel drawn as a black-and-white picture. The low planes of a natural photo look like random noise. A hidden picture can show shapes in the low planes of the channels that carry it, so the Bit Plane Analysis view can help you check by eye.
Related Tools
Image-in-Image Hider
Hide a secret image inside a cover image in your browser. Choose the bit depth and channels, add an optional AES-256 password, and see a measured PSNR and SSIM quality report. The result is saved as a PNG.
Steganography Detector
Statistical steganalysis with three published tests — chi-square, RS analysis and Sample Pairs — fused into one score and checked against the real StegExpose on a small test set. Payload size estimate. Method fingerprint. WAV audio support. Processed in your browser, not uploaded.
Text-in-Image Hider
Hide secret text inside an image with Sequential, Seeded Scatter or Adaptive Edge LSB. Shows PSNR and SSIM after encoding, optional AES-256 password, and always saves a PNG.
Text-in-Image Extractor
Extract hidden text from images. Auto-Detect tries 11 common LSB settings; manual mode, bit plane viewer, chi-square pre-scan, CTF flag detection and an optional AES-256 password.