Metadata Steganography Extractor
Extract hidden data from PNG chunks, PDF metadata, GIF comments, MP3 ID3 tags, or DOCX/XLSX properties. MSTEG auto-detect, full metadata viewer, CTF flag detector.
Try the demo instantly
Loads a stego PNG with a hidden message already embedded in a tEXt chunk — auto-extracts instantly
Drop your PNG, GIF, PDF, MP3, or DOCX/XLSX here
JPEG not supported here — use the EXIF Data Hider
100% Client-Side Processing
Your file is processed entirely in this browser tab. Nothing is uploaded to any server.
How to Extract Data from File Metadata (5 steps)
- Upload the PNG, GIF, PDF, MP3, or DOCX/XLSX file you want to check
- Click Auto Extract — if encoded with the companion Hider, it extracts automatically
- If no MSTEG header: every field is scanned and ranked by suspicion
- Enter passphrase if the payload was encrypted
- Copy the message or download the hidden file
Metadata Steganography — 8 Hiding Targets Compared
| Target | Mechanism | Capacity | Best For |
|---|---|---|---|
| PNG tEXt chunk | ASCII key=value chunk before IEND | Unlimited | Short messages, CTF flags — the #1 PNG hiding location |
| PNG iTXt chunk | UTF-8 text, optional zlib compression | Unlimited | Longer messages, international characters |
| PNG zTXt chunk | Always zlib-compressed ASCII | Unlimited (compressed) | Large text payloads, best size/capacity ratio |
| PNG custom chunk | Private ancillary chunk, binary-safe | Unlimited | Binary payloads, advanced CTF hiding |
| PDF metadata field | Info dictionary (Author, Keywords, ...) | ~32 KB per field | Document watermarking, invisible fingerprinting |
| GIF comment | Comment Extension block (0x21 0xFE) | Unlimited | GIF-specific CTF challenges |
| MP3 ID3 tag | TXXX/COMM/PRIV/USLT frame | Unlimited | Audio file watermarking |
| DOCX/XLSX property | Custom document property (docProps/custom.xml) | ~1 MB | Office document fingerprinting |
Frequently Asked Questions
What does this tool find that a normal metadata viewer misses?
It doesn't just list fields — it validates each one's value against the MSTEG v1 header format (CRC32 checksum), scans for CTF flag patterns (flag{...}, CTF{...}, HTB{...}, etc.), flags non-standard chunk types and bytes appended after a PNG's IEND, and decrypts AES-256-GCM payloads when given the right passphrase.
How does MSTEG auto-detect work?
Every metadata field discovered during the scan is checked for a valid 16-byte MSTEG v1 header (magic bytes + CRC32). If found, the target format, encryption flag, compression flag, and payload length are all read from the header — zero configuration required to decode.
What if there's no MSTEG header?
The file may have been encoded by a different tool, edited after encoding, or hides data directly without a header (common in CTF challenges). The Extractor falls back to a full-scan: every field is ranked by suspicion — CTF flag matches score highest, followed by non-standard fields and high-entropy/base64-looking content.
My extraction found something but it looks like garbage — why?
Most likely the payload was AES-256-GCM encrypted. Enter the passphrase used during encoding and try again. Alternatively the full-scan may have picked the wrong field — switch to Forensic mode and try Manual field selection.
Does this replace ExifTool?
For casual detection and CTF work, yes — everything runs in your browser with zero install. For deep forensic analysis across every file format ExifTool supports, the CLI tool remains more thorough. This tool focuses specifically on the steganography-relevant metadata surfaces: PNG chunks, PDF Info fields, GIF comments, MP3 ID3 tags, and DOCX/XLSX custom properties.