Palette Steganography Extractor
Extract hidden text or files from GIF, indexed PNG, or 8-bit BMP palettes. PALSTEG auto-detect, luminance-sort detection, chi-square analysis, ranked brute-force, CTF flag detector. 100% client-side.
Before uploading: share the output only as a file attachment (email, Telegram, Discord file). Social image upload or GIF platforms (Giphy/Tenor) re-encode GIFs and destroy hidden data.
Try demo — see hidden message extracted instantly
Loads a 256-colour sample GIF — no upload needed
Drop a GIF, indexed PNG, or 8-bit BMP here
RGB PNG and JPEG not supported (no palette)
100% Client-Side Processing
Your image is processed entirely in this browser tab. Nothing is uploaded.
How to Extract Palette Steganography (5 steps)
- Upload the GIF, indexed PNG, or 8-bit BMP to check
- Click Extract — a PALSTEG header decodes instantly if present
- For CTF images with no header: view the palette analysis or run brute-force
- Enter a passphrase if the payload was AES-256 encrypted
- Copy the text or download the hidden file
Palette Steganography Decoding — What This Tool Handles
| Method | Technique | When to Use | Best For |
|---|---|---|---|
| PALSTEG auto-detect | Reads the 20-byte header from palette entry LSBs | Companion-encoded files | Instant, zero-config extraction |
| Luminance sort detection | Compares palette order to a luminance-sorted copy | No header present | Flags the classic EZ Stego CTF signal |
| Chi-square on parity | Tests palette-parity distribution for bias | No header present | Flags Westfeld / PRNG embedding |
| Ranked brute-force | Tries 8 common palette stego configurations | No header present | CTF challenges, unknown encoders |
Frequently Asked Questions
How do I know if a GIF uses EZ Stego?
View the palette in sorted order. EZ Stego always produces a luminance-sorted palette — colours run darkest to lightest in sequence. The palette analyser in Forensic mode shows both the original order and the luminance-sorted order side by side.
What is chi-square palette analysis?
In natural images, palette-entry parity ((R+G+B) % 2) is roughly 50% even / 50% odd. Westfeld's parity embedding distorts this distribution to match the payload. A p-value below 0.05 suggests possible embedding.
What is a visual colour attack?
It looks for near-duplicate colour pairs in the palette — two entries that are almost identical. These appear in stego images because parity-swap methods replace colours with their nearest opposite-parity partner. Natural images have few near-duplicates; stego images often have many.
My brute-force found garbage — why?
The payload was likely AES-256-GCM encrypted. Enter the passphrase and try again. If using PRNG mode, the passphrase also seeds the pixel selection order — without it, extraction fails regardless of decryption.
Is my image uploaded anywhere?
Never. All decoding runs entirely in your browser using a WebWorker and the Web Crypto API.
Related Tools
Palette Steganography Hider
Hide text or files inside GIF, indexed PNG, or 8-bit BMP colour palettes using Palette LSB, EZ Stego, Westfeld Parity, or PRNG Index Swap. AES-256, visual palette comparison. 100% client-side.
Image Steganography Extractor
Extract hidden messages from steganographic image files. Auto-detect mode, bit plane analysis.
Steganography Detector
Statistical steganalysis using four algorithms — chi-square, RS analysis, sample pairs, primary sets. StegExpose-equivalent. Payload size estimate. Method fingerprint. WAV audio support. No upload.