Image Steganography Extractor

It reads data written by the Image Steganography Hider and by other tools that use plain LSB embedding with a 4-byte big-endian length in front of the payload: Basic LSB, Custom LSB (1–8 bits), Adaptive LSB, DCT and Spread Spectrum. A different layout will not be read even if it is also LSB-based; for those try the LSB Extractor or a general tool such as zsteg or StegSolve. Data hidden by file-structure tricks (extra bytes after the image, metadata chunks) is not in the pixels, so this tool will not see it: use the PNG Steganography Extractor or the Steganography Analyzer.

Opening a JPEG works, but if the hidden data was written into a PNG and the PNG was later converted to JPEG, the LSB data is normally gone. In our tests LSB data was lost at every JPEG quality we tried; DCT was recovered only at quality 100 and Spread Spectrum down to quality 60 (see the test table on the Hider page).

Quick and Standard modes run eight attempts: LSB 1-bit on R+G+B, LSB 2-bit on R+G+B, LSB 3-bit on R+G+B, Adaptive LSB, LSB 1-bit on red only, on green only and on blue only, and DCT. It does not try 4 to 8 bits, Spread Spectrum, a seed (random pixel order), the alpha channel or least-significant-bit-first ordering. Anything hidden with those settings needs Forensic mode and the matching settings; the Extractor cannot discover them from the file because the format has no signature.

Each attempt reads a 4-byte length and then that many bytes, and the bytes are classified. A known file signature (PNG, ZIP, PDF and so on) is "likely file". More than 7.2 bits of entropy per byte, or the exact layout of an encrypted payload (a length that matches the data), is "likely encrypted". More than 70% printable characters in the first 100 bytes is "likely plaintext". Everything else is "likely noise". These are guesses from the bytes, not proof: ordinary random-looking image noise can be read as a length and produce a plausible-looking candidate, so check that the text actually makes sense.

Quick and Standard open the result for you when exactly one readable answer exists. Several attempts often read the same message (Adaptive LSB and LSB 2-bit often agree), and the tool compares a fingerprint of the full payload to see that they are one answer, not a tie. If different attempts read different text, nothing is opened and you choose from the list. Forensic mode always starts on the full list.

If a password was set when hiding, the recovered bytes are AES-256-GCM ciphertext and look random. When Auto-Detect finds only data of that shape, the result says "Hidden Data Found That Looks Encrypted" with a field to enter the password and try again. That wording is deliberately hedged: the tool infers encryption from the length field and entropy; only a password that passes the authentication tag proves it. A wrong password and damaged data both just fail.

The password is turned into a key with PBKDF2-HMAC-SHA-256 (100,000 iterations) and the salt stored in the payload, and the AES-256-GCM authentication tag then checks it. A wrong password and a damaged payload both simply report failure, so the tool cannot tell you which it was, and there is no way to recover a forgotten password. The full description, including what this scheme does not protect, is on the Image Steganography Hider page.

Bit depth is how many low bits per channel were overwritten (1 to 8). Channels select red, green, blue, alpha or all of R+G+B. Bit order only matters for depths above 1 bit: the default reads the highest of the overwritten bit positions first, which is what this site's Hider writes; the other option is for images made by a tool that packs the bits the other way. The seed (0 to 999,999,999) must match the Hider's seed exactly; without it a randomised file reads as noise. Spread Spectrum is not part of Auto-Detect: choose it directly and enter the same seed (the Hider's default is 42 when no seed was set).

Strings (printable runs of at least four characters), a hex view and 24 bit-plane images (each bit of R, G and B) are shown in Forensic mode, and CTF-style flags such as flag{...} are highlighted. The bit planes are a classic manual check: LSB data tends to look like noise in the lowest planes. The tool computes the 24 planes only when you open that tab.