Image Watermark Embedder

A visible watermark is text or a logo drawn on the picture. It deters casual reuse and shows who made the image, but anyone can crop, blur or paint over it. An invisible watermark stores the same text in the image's frequency data so a program can read it later. Neither creates copyright (in many jurisdictions it arises automatically for an eligible original work; laws vary), neither is a digital signature, and neither watermark by itself establishes legal ownership: the invisible mark has no key, so anyone with this tool, or a program that follows the same layout, could embed or read the same text.

The invisible watermark is built to survive JPEG re-encoding, not editing that moves pixels. In our tests the text was read back exactly after JPEG quality 95 down to 60 for every strength. In our tests it was not read when the image was resized to 90% and kept at that smaller size (0 of 16) or cropped (offsets of 1 to 13 pixels: 0 of 8). The likely reason is that the position of each bit depends on the image's block grid, which a change of dimensions moves; we did not test that explanation separately. Resizing and then returning to the original dimensions sometimes kept the text (exact 2× down and back: 8 of 8; bilinear 50%, 75% and 90% and back: 6 of 8 each), so the result depends on the resampling method. Rotation, perspective changes, screenshots and printing were not tested systematically and may prevent recovery.

The image's brightness (the Y channel of YCbCr) goes through a one-level Haar wavelet transform. The low-frequency LL subband is cut into 8 × 8 blocks, and each block gets a 2-D discrete cosine transform. In every block the largest non-DC coefficient is moved to a quantization-index-modulation target: with step S, a coefficient c is replaced by (floor(c ÷ S) + 0.25) × S for a 0 bit and (floor(c ÷ S) + 0.75) × S for a 1 bit. S is 20, 36, 52 or 68 for Light, Balanced, Archival and Maximum. The blocks are transformed back to pixels.

Your text is converted to UTF-8 bytes and its bits are written in order, repeated over every block (block k carries bit number k mod (8 × L), where L is the text's length in bytes, so the bits repeat in a cycle). One copy of the text therefore occupies 8 × length blocks, and an 800 × 600 image has 1,850 blocks. Reading takes a majority vote over all copies of each bit, which is why the text can be recovered exactly even when some blocks are damaged. The text length and the strength are not stored in the image: the reader has to be told them or has to try all of them (see the Detector).

The text can be up to 100 characters, and a smaller text gives more repeated copies. The Detector attempts a blind reading (without being told the length) only when each bit has at least 12 copies, a rule built into it, so the longest text it can read blind is the number of blocks ÷ 96 bytes, up to 128 bytes: 4 bytes in 400 × 300 pixels, 12 in 640 × 480, 19 in 800 × 600 and 83 in 1920 × 1080. The minimum is 12 because with 5 to 11 copies the blind reader sometimes returned a wrong text in our measurements, while with 12 or more it returned none in that set (it declined to read instead). That is a measured result on our test images, not a guarantee for every image or edit. A text that is longer than the blind limit is still embedded and can be read when its length is known, but the Detector will report that a pattern exists without showing the text, and exact recovery is not reliable with few copies. A text that does not fit even once (more bits than the image has blocks) is refused with the numbers instead of being cut off. The form shows, while you type, how many times the text is stored. Characters outside ASCII (© is 2 bytes) count by their UTF-8 length. Images smaller than 16 × 16 pixels cannot carry the invisible mark, and under 200 pixels the tool warns you.

PSNR and SSIM are computed between your original and the result. On the photograph crops we measured, the invisible mark alone gave about 47 dB (Light), 41 dB (Balanced), 38 dB (Archival) and 35 dB (Maximum). PSNR is computed over R, G and B and the SSIM shown is a simplified whole-image luminance version, not the usual windowed SSIM. Higher is a smaller change; neither number says whether the watermark would be noticed in a particular picture, so compare the previews. The visible overlay is included in the figure when it is on.

In Forensic mode you can switch on a check that runs after embedding and reports whether your exact text is read back after five changes to this image: JPEG at quality 80 and at 60 (encoded by your own browser, so another program's encoder may differ), brightness +20%, contrast +20% and a 50% resize and back. A change counts as survived only when the whole text is recovered exactly. The resize line scales by exactly 2 and back to the original size, a round trip that keeps the mark aligned, so it normally passes; it does not show that sharing a smaller copy is safe (a smaller copy lost the mark in every test). If your browser cannot encode JPEG in a worker, those two checks are shown as not run instead of being estimated. The check does not test any website or app.

Forensic mode can make one copy per recipient: for each line of a recipient list (blank lines and exact duplicates are removed) an identifier is derived from your master key and the recipient with HKDF-SHA-256 (the first 16 hexadecimal characters of the output, which stand for 64 bits of key material), and that identifier is embedded as the invisible text. You receive a ZIP of the copies and a key file that maps identifiers to recipients; keep the key file, because the image alone cannot tell you who got it. The run is refused without a master key or recipients, with more than 200 recipients, or when the copies would need more than 800 MB of memory (width × height × 4 bytes per copy). Written as text, each identifier is 16 ASCII characters, that is 16 bytes or 128 embedded bits (twice the 64 bits of key material, because each hex character takes a whole byte), so the Detector can read it blind only when the image has at least 1536 blocks, for example 1850 blocks in 800 × 600 (14 copies) but only 1200 in 640 × 480; in a smaller image it can still flag the pattern, and you compare the leaked file against the IDs in the key file. Batch visible watermarking applies the same overlay to many images and returns a ZIP.