JPEG Steganography Extractor
Extract hidden data from JPEG images encoded with F5, JSteg, or JPEG Comment/APP metadata. DCT scan mode, brute-force mode, and CTF heuristic guess mode included.
Upload stego JPEG to decode
JPEG image that may contain hidden metadata
Supports JPEG/JPG files · max 50 MB desktop, 20 MB mobile
How to Extract Hidden JPEG Data (5 steps)
- Upload the JPEG image you want to check.
- Click Scan — see DCT coefficient anomalies (chi-square score, LSB bias) before decoding.
- Click Decode, or use Brute-Force for unknown methods.
- Enter a passphrase if the payload was encrypted or F5-protected.
- Copy the message or download the hidden file.
JPEG Steganography Detection Methods
| Method | Technique | Detection | Best For |
|---|---|---|---|
| Auto-Detect | Scans metadata segments, then genuinely attempts F5 and JSteg extraction | High detection rate | Unknown encoding method |
| F5 | Extracts via f5stegojs's matrix decoding — requires the passphrase if one was used | Real DCT-domain extraction | When F5 is confirmed or suspected (via Scan Mode) |
| JSteg | Reads LSBs of non-zero, non-one DCT coefficients | Real DCT-domain extraction | When JSteg is confirmed or suspected (via Scan Mode) |
| JPEG Comment / APP Extension | Searches COM (0xFFFE) / APP3 (0xFFE3) segments for this tool's header | Direct, fast extraction | When a metadata method is confirmed |
| Brute-Force | Tries Comment → JSteg → F5 (with passphrase) → F5 (no passphrase) → CTF heuristic, in order | Slowest, most thorough | Unknown method, CTF challenges |
| CTF Heuristic Guess Mode | Attempts common CTF extraction patterns — NOT true steghide decoding | Best-effort only | steghide-style CTF challenges (use the real steghide CLI if this fails) |
Frequently Asked Questions
Why don't zsteg or stegsolve decode JPEG steganography?
zsteg and stegsolve operate on pixel data. JPEG steganography (JSteg, F5) embeds data in quantized DCT coefficients — the frequency-domain representation of pixel blocks. Pixel-domain tools are blind to it. This decoder analyzes JPEG DCT coefficients directly.
How do I decode a steghide JPEG CTF challenge?
steghide uses graph-theoretic embedding — not DCT LSB or F5. CTF Heuristic Guess Mode tries common passphrase-based extraction patterns some CTF challenges use, but it is NOT true steghide. If it fails, the challenge likely requires the actual steghide CLI (`steghide extract -sf file.jpg`).
The scan says 'likely JSteg' but decode returns nothing — why?
The chi-square test shows a statistical anomaly, not certainty. The JPEG may have been re-encoded after embedding (social platform upload), which changes DCT coefficients and destroys the embedding. Check if you have the original file vs. a re-encoded copy.
Can this detect outguess?
Not yet. outguess corrects the DCT histogram after embedding to disguise its statistical signature, which is much harder to detect than JSteg's LSB bias or F5's shrinkage pattern.
Why is my extracted data showing as encrypted?
If the original encoder used a passphrase, the payload is AES-256-GCM encrypted. Enter the same passphrase used at encode time.
What does the suspicion score mean?
A composite 0-100 score combining metadata-marker hits (100 = this tool's own header found) and the DCT chi-square/LSB-bias signal. It's a heuristic, not proof — recompressed or noisy JPEGs can show a similar signal without containing steganography.