PDF Steganography Extractor

This extractor reads payloads written by the PDF Steganography Hider on this site. Each of its five methods looks in one exact place for one exact key name — the Keywords field with the STEGO_META_V1: marker, the Catalog entries StegoITData and StegoObjStream, the page Resources entry StegoWSData, and the StegoFontData key. If a PDF holds hidden data placed anywhere else, or under a different name, this tool will report that nothing was found.

That is a real limit for people searching for hidden data in an unknown PDF, for example in a CTF challenge. For those files, start with tools that show everything: the Polyglot File Analyzer for appended or embedded formats, the Strings Analyzer for readable text, the Hex Viewer for the raw bytes, and the PDF Metadata Steganography Extractor, which reads six different metadata and structure methods.

The Extractor only reads the file; it never changes it, and the PDF is not sent to a server. An extracted file comes from whoever made the PDF, so treat it like any download: do not open an unknown file just because it came out of a PDF. A password-protected PDF is refused. If the payload was encrypted and you do not have the passphrase, the data stays unreadable and nothing here can recover it.

Auto Detect tries the five methods in this order: Metadata, Invisible Text, Whitespace, Object Stream, Font Encoding. For each one it loads the PDF, reads the one location that method uses, and reports whether a payload was there. The scan stops early at the first clear text or file payload; otherwise every method is tried, each result is listed, and the best one (text, then file, then binary, then encrypted) is shown. The scan does not guarantee that every payload in a PDF is extracted. You can also pick a single method if you know how the file was made.

Each method either finds its marker and key or finds nothing. There is no guessing from the page content, so a found marker identifies a candidate payload at the expected location; successful decoding or authenticated decryption is stronger confirmation. These are three different outcomes: a marker found, a payload recovered, and (for an encrypted payload) authentication succeeded. A failed scan tells you only that this tool's fixed locations are empty.

Alongside the extraction, the tool inspects the PDF's structure and shows a score from 0 to 100. It is the sum of four parts, each worth up to 25: metadata, invisible text, object stream and font encoding. A part scores when the tool finds its own marker — the STEGO_META_V1 / STEGO_WS_V1 Keywords prefix, the StegoWSData, StegoITData, StegoObjStream or StegoFontData keys — or, for metadata only, a Keywords field that is unusually long (over 200 characters) or that looks like a long Base64 string. The label is Low up to 20, Medium above 20, and High above 50. The score has four parts for five methods because Whitespace Manipulation's fingerprints are counted inside the metadata part. This Hider's Whitespace Manipulation writes the page 1 Resources key StegoWSData, which scores 18 there, and no Keywords prefix; the 25-point rule for a Keywords value starting STEGO_WS_V1: applies only to a file that has that prefix. Font Encoding scores 25 when the PDF has an embedded font (the key sits in the font dictionary) and 20 when it has none (the key falls back to the page Resources).

So the score tells you how many of this tool's own fingerprints are present. It is not a general steganalysis measure: a PDF carrying data by some other technique scores 0, and a high score on a file you did not make with this tool suggests matching key names or metadata patterns are present.

If the payload was encrypted, the extracted bytes are AES-256-GCM ciphertext until you supply the password; a wrong password fails authentication and the raw bytes are shown instead of text, with a note that a wrong passphrase and damaged data cannot be told apart. A password typed for a payload that was never encrypted is simply not used. A green note appears only when AES-GCM authentication succeeded. The interpreter then classifies what it has: a known file signature (PDF, ZIP, PNG, JPEG, GIF, MP3 and others) is offered as a download, mostly-printable low-entropy bytes are shown as text, and data that matches this toolkit's encrypted layout or has very high entropy is flagged as probably encrypted.

If the Hider's RS option was used, the wrapper is detected by its header and removed first. In theory the Extractor can repair up to 5, 10 or 15 changed bytes per 223-byte block (RS-10, RS-20, RS-30), provided it can locate the block and the errors stay within that limit, and it reports blocks it cannot repair.

The password is turned into a key with PBKDF2-HMAC-SHA-256 (100,000 iterations) and the salt stored in the payload, and the AES-256-GCM authentication tag then checks it. A wrong password and a damaged payload both simply report failure, so the tool cannot tell you which it was, and there is no way to recover a forgotten password. The full description, including what this scheme does not protect, is on the PDF Steganography Hider page.