StegoToolkit

Metadata Steganography Hider

Hide text or files in PNG text chunks, PDF metadata fields, GIF comments, MP3 ID3 tags, or DOCX/XLSX custom properties. No pixels touched. AES-256-GCM.

AES-256
8 Targets

Try the demo instantly

Loads a 200×200 demo PNG — no upload needed

Drop your PNG, GIF, PDF, MP3, or DOCX/XLSX here

JPEG not supported here — use the EXIF Data Hider

100% Client-Side Processing

Your file is processed entirely in this browser tab. Nothing is uploaded to any server.

How to Hide Data in File Metadata (5 steps)

  1. Upload a PNG, GIF, PDF, MP3, or DOCX/XLSX file — it's analysed instantly
  2. Choose where to hide (PNG tEXt chunk is recommended for images)
  3. Type your secret message or upload a file to hide
  4. Add a passphrase for AES-256 encryption (recommended)
  5. Click Embed — download the file with hidden metadata

Metadata Steganography — 8 Hiding Targets Compared

TargetMechanismCapacityBest For
PNG tEXt chunkASCII key=value chunk before IENDUnlimitedShort messages, CTF flags — the #1 PNG hiding location
PNG iTXt chunkUTF-8 text, optional zlib compressionUnlimitedLonger messages, international characters
PNG zTXt chunkAlways zlib-compressed ASCIIUnlimited (compressed)Large text payloads, best size/capacity ratio
PNG custom chunkPrivate ancillary chunk, binary-safeUnlimitedBinary payloads, advanced CTF hiding
PDF metadata fieldInfo dictionary (Author, Keywords, ...)~32 KB per fieldDocument watermarking, invisible fingerprinting
GIF commentComment Extension block (0x21 0xFE)UnlimitedGIF-specific CTF challenges
MP3 ID3 tagTXXX/COMM/PRIV/USLT frameUnlimitedAudio file watermarking
DOCX/XLSX propertyCustom document property (docProps/custom.xml)~1 MBOffice document fingerprinting

Frequently Asked Questions

How is this different from the EXIF Data Hider?

EXIF Data Hider targets JPEG-specific fields: UserComment, ImageDescription, GPS coordinates, IPTC caption. This tool targets non-JPEG metadata surfaces: PNG tEXt/iTXt/zTXt/custom chunks, PDF Info dictionary fields, GIF comment extensions, MP3 ID3 tags, and DOCX/XLSX custom properties. Use EXIF Data Hider for JPEG files.

Will the file look different after embedding?

No. PNG and GIF metadata injection adds data to the header layer — zero pixel values are modified. Audio and document content is unchanged. File size increases slightly by the size of the embedded field.

Can exiftool detect what I've hidden?

ExifTool will show that the field exists and display its value — the MSTEG header plus your AES-encrypted payload, which looks like random base64 text. ExifTool cannot decrypt AES — the content is unreadable without your passphrase.

Does metadata survive social media upload?

Typically no. Most social platforms (Instagram, Twitter/X, Facebook, Discord image upload) strip metadata when processing uploaded images. Share the file as an attachment instead — email, Google Drive, Dropbox, or Telegram file transfer preserve metadata intact.

What's the MSTEG header for?

Every encoded file includes a 16-byte MSTEG v1 header (target, encryption flag, compression flag, payload length, CRC32) embedded alongside your payload. The Metadata Steganography Extractor scans every metadata field for this header automatically — zero configuration needed to decode. You can turn it off in Forensic mode for CTF-style headerless hiding.

What happens if my payload doesn't fit?

PDF fields cap out around 32 KB. You'll see a capacity warning with an 'Auto fix for me' button that enables compression, or you can manually pick a different target (PNG/GIF/MP3/DOCX all have effectively unlimited capacity).