PDF Steganography Extractor
Extract hidden messages and files from steganographic PDF documents. Auto-detects encoding method.
Drop PDF here or click to browse
Accepted: PDF | Max: 200 MB
100% Client-Side Processing
Your PDF never leaves your device. All processing happens in your browser.
How the Extractor Works (4 steps)
- Upload the PDF file that may contain a hidden payload
- Select the detection method (or use Auto to scan all methods)
- Enter a password if the payload was encrypted during encoding
- Click Decode — the hidden message or file will be extracted below
5 PDF Extraction Methods
| Method | Technique | Detection Risk | Best For |
|---|---|---|---|
| Metadata Fields | Keywords / Subject Info dictionary keys | 🔴 Low — visible to any PDF viewer | CTF metadata challenges, quick extraction |
| Invisible Text | Off-page text at white color, size ≈ 0 | 🟡 Medium — requires content-stream parser | CTF forensics, invisible text payloads |
| Whitespace | Tw word-spacing operator deltas per page | 🟢 High — spacing changes are subtle | Stealthy text PDFs, stealth payloads |
| Object Stream | Hidden PDFRawStream referenced from catalog | 🟡 Medium — requires XRef table traversal | Binary payloads, large hidden files |
| Font Encoding | StegoFontData key embedded in font dictionaries | 🟢 High — requires per-font dict inspection | Maximum stealth, expert-level encoding |
Frequently Asked Questions
Will decoding modify my PDF?
No. Decoding is read-only — the original PDF is never altered. A copy of the extracted payload is returned to your browser.
Is my PDF uploaded to a server?
Never. All extraction happens entirely in your browser using the Web Crypto API. Your file never leaves your device.
Which method should I try first?
Choose Auto Detect. It scans all five methods in order and returns the first payload it finds. Only switch to a specific method if you know how the PDF was encoded.
Why is the output garbled?
The payload was likely encrypted. Enter the same password used during encoding and try again.
Can I extract files, not just text?
Yes. If the hidden payload is a file it will be offered as a download in its original format after extraction.