StegoToolkit

JPEG Steganography Extractor

Extract hidden data from JPEG images encoded with F5, JSteg, or JPEG Comment/APP metadata. DCT scan mode, brute-force mode, and CTF heuristic guess mode included.

Upload stego JPEG to decode

JPEG image that may contain hidden metadata

or drag and drop

Supports JPEG/JPG files · max 50 MB desktop, 20 MB mobile

How to Extract Hidden JPEG Data (5 steps)

  1. Upload the JPEG image you want to check.
  2. Click Scan — see DCT coefficient anomalies (chi-square score, LSB bias) before decoding.
  3. Click Decode, or use Brute-Force for unknown methods.
  4. Enter a passphrase if the payload was encrypted or F5-protected.
  5. Copy the message or download the hidden file.

JPEG Steganography Detection Methods

MethodTechniqueDetectionBest For
Auto-DetectScans metadata segments, then genuinely attempts F5 and JSteg extractionHigh detection rateUnknown encoding method
F5Extracts via f5stegojs's matrix decoding — requires the passphrase if one was usedReal DCT-domain extractionWhen F5 is confirmed or suspected (via Scan Mode)
JStegReads LSBs of non-zero, non-one DCT coefficientsReal DCT-domain extractionWhen JSteg is confirmed or suspected (via Scan Mode)
JPEG Comment / APP ExtensionSearches COM (0xFFFE) / APP3 (0xFFE3) segments for this tool's headerDirect, fast extractionWhen a metadata method is confirmed
Brute-ForceTries Comment → JSteg → F5 (with passphrase) → F5 (no passphrase) → CTF heuristic, in orderSlowest, most thoroughUnknown method, CTF challenges
CTF Heuristic Guess ModeAttempts common CTF extraction patterns — NOT true steghide decodingBest-effort onlysteghide-style CTF challenges (use the real steghide CLI if this fails)

Frequently Asked Questions

Why don't zsteg or stegsolve decode JPEG steganography?

zsteg and stegsolve operate on pixel data. JPEG steganography (JSteg, F5) embeds data in quantized DCT coefficients — the frequency-domain representation of pixel blocks. Pixel-domain tools are blind to it. This decoder analyzes JPEG DCT coefficients directly.

How do I decode a steghide JPEG CTF challenge?

steghide uses graph-theoretic embedding — not DCT LSB or F5. CTF Heuristic Guess Mode tries common passphrase-based extraction patterns some CTF challenges use, but it is NOT true steghide. If it fails, the challenge likely requires the actual steghide CLI (`steghide extract -sf file.jpg`).

The scan says 'likely JSteg' but decode returns nothing — why?

The chi-square test shows a statistical anomaly, not certainty. The JPEG may have been re-encoded after embedding (social platform upload), which changes DCT coefficients and destroys the embedding. Check if you have the original file vs. a re-encoded copy.

Can this detect outguess?

Not yet. outguess corrects the DCT histogram after embedding to disguise its statistical signature, which is much harder to detect than JSteg's LSB bias or F5's shrinkage pattern.

Why is my extracted data showing as encrypted?

If the original encoder used a passphrase, the payload is AES-256-GCM encrypted. Enter the same passphrase used at encode time.

What does the suspicion score mean?

A composite 0-100 score combining metadata-marker hits (100 = this tool's own header found) and the DCT chi-square/LSB-bias signal. It's a heuristic, not proof — recompressed or noisy JPEGs can show a similar signal without containing steganography.