StegoToolkit

PNG Steganography Extractor

Extract hidden data from PNG-native steganography — chunk inspection, EOF scan, alpha channel, row filter analysis, and LSB in IDAT. PNGSTEG v1 auto-detect across all 5 surfaces, brute-force scoring, AES-256-GCM decryption, CTF flag detector.

Auto-detect
Brute-Force

Try the demo instantly

Loads a stego PNG with a hidden message already embedded in a tEXt chunk — auto-extracts instantly

Drop a PNG here, or click to browse

PNG only — chunk architecture is PNG-specific

100% Client-Side Processing

Your PNG is processed entirely in this browser tab. Nothing is uploaded to any server.

How to Extract PNG Steganography (5 steps)

  1. Upload the PNG file to check
  2. Click Auto Extract — scans Chunk Injection, EOF Append, Alpha Channel, Row Filter Encoding, and LSB in IDAT automatically
  3. For unknown files: switch to Forensic mode and run Brute-Force
  4. Enter a passphrase if the payload was AES-256 encrypted
  5. Copy the decoded text or download the hidden file

Frequently Asked Questions

What order does Auto Extract scan surfaces in?

Chunk Injection first (tEXt, iTXt, zTXt, then any custom ancillary chunk), then EOF Append, then Alpha Channel, then Row Filter Encoding, then LSB in IDAT — matching the priority order real CTF challenges most commonly use. The first valid PNGSTEG header found wins.

Why didn't Auto Extract find my Row Filter Encoding payload?

Row Filter Encoding only works on non-interlaced PNGs up to 512×512 — if the file is larger, interlaced, or was re-saved/re-compressed by any other tool after encoding (which rewrites every scanline's filter choice), the payload is gone. This is the most fragile of the 5 methods by design.

Can this decode files from zsteg, pngcheck, or other PNG tools?

This tool's own PNGSTEG v1 header is only written by the companion PNG Steganography Hider, so auto-detect won't fire on files from other tools. Switch to Forensic mode and use Brute-Force — it scores every ancillary chunk and the EOF region for printable/CTF-flag content without requiring a header.

Why does it say 'header found — incorrect password'?

A valid PNGSTEG header was located, and its flags confirm the payload is AES-256-GCM encrypted, but decryption failed — the password field was left blank or doesn't match what was used during encoding. Enter the correct passphrase and try again.

The chunk list shows non-standard chunks but nothing decodes — why?

A non-standard ancillary chunk (lowercase first letter) doesn't guarantee it's steganography — it could be from an unrelated tool, or the data inside doesn't follow this tool's own wire format. Use the Full Chunk List panel (Forensic mode) to inspect it manually, or try Brute-Force to score its content.

Does the extractor modify my file?

No — reading a PNG's chunks and EOF bytes never modifies the file. Only the Alpha Channel and LSB in IDAT surfaces require decoding pixels (via Canvas), and that's a read-only operation on this tool's own copy in memory; your original upload is never altered.

Related Tools