StegoToolkit

Image Steganography Hider

Hide secret messages or files inside PNG, BMP, or WebP images. AES-256 encrypted, 100% client-side.

Drop image file or click to browse

PNG, BMP, WebP, TIFF, JPEG — max 50 MB (10 MB on mobile)

100% Client-Side Processing

Your image is decoded using the Canvas API entirely in your browser. Nothing is uploaded. Output is always lossless PNG.

How to Hide a Message in an Image (5 steps)

  1. Upload a PNG, BMP, or WebP image as your carrier.
  2. Enter the secret message or file you want to hide.
  3. Choose an algorithm — Adaptive LSB is the best default.
  4. Optionally set a password for AES-256-GCM encryption.
  5. Click Encode — download the stego image as PNG.

Image Steganography Methods — Algorithm Comparison

MethodSpeedCapacityBest For
Basic LSB 1-bit⚡ Fast📦 MediumShort messages, maximum quality
Adaptive LSB⚡ Fast📦 HighBest balance — recommended default
Custom LSB (1–8 bit)⚡ Fast📦 VariableCTF challenges requiring specific bit depth
DCT Domain🐢 Slow📦 LowImages re-saved on social platforms
Spread Spectrum⚡ Fast📦 Very LowMaximum stealth, small payloads

Frequently Asked Questions

Which image formats can I use as carriers?

PNG, BMP, WebP, and TIFF work best as they are lossless formats that preserve every pixel. JPEG is lossy — re-saving as JPEG destroys LSB data. If you must use JPEG, choose DCT mode which is designed to survive some compression.

What algorithm should I choose?

Adaptive LSB is the recommended default — it uses edge detection to hide more bits in textured areas where changes are imperceptible, giving the best balance of capacity and quality. For maximum stealth against statistical analysis, use Spread Spectrum.

How does seed-based pixel selection work?

When you enter a seed number, the tool shuffles which pixels are used for hiding data using a deterministic algorithm. This means you must use the same seed to extract. The seed acts as a second layer of security independent of the password.

What is PSNR and what does the score mean?

PSNR (Peak Signal-to-Noise Ratio) measures image quality in decibels. Above 40 dB is Excellent (imperceptible to humans). 30–40 dB is Good. Below 30 dB means visible changes. 1-bit LSB typically achieves 50+ dB.

Will the hidden data survive if I share the image?

LSB data survives lossless transfers (direct file copy, Google Drive, Dropbox, Discord PNG). It is destroyed by JPEG re-compression (Instagram, WhatsApp, Twitter). Use DCT mode for images that will be shared on social platforms.

Is my data encrypted?

Setting a password encrypts the payload with AES-256-GCM before embedding. Without a password, the raw bytes are embedded. We always recommend setting a password for sensitive data.