PNG Steganography Extractor
Extract hidden data from PNG-native steganography — chunk inspection, EOF scan, alpha channel, row filter analysis, and LSB in IDAT. PNGSTEG v1 auto-detect across all 5 surfaces, brute-force scoring, AES-256-GCM decryption, CTF flag detector.
Try the demo instantly
Loads a stego PNG with a hidden message already embedded in a tEXt chunk — auto-extracts instantly
Drop a PNG here, or click to browse
PNG only — chunk architecture is PNG-specific
100% Client-Side Processing
Your PNG is processed entirely in this browser tab. Nothing is uploaded to any server.
How to Extract PNG Steganography (5 steps)
- Upload the PNG file to check
- Click Auto Extract — scans Chunk Injection, EOF Append, Alpha Channel, Row Filter Encoding, and LSB in IDAT automatically
- For unknown files: switch to Forensic mode and run Brute-Force
- Enter a passphrase if the payload was AES-256 encrypted
- Copy the decoded text or download the hidden file
Frequently Asked Questions
What order does Auto Extract scan surfaces in?
Chunk Injection first (tEXt, iTXt, zTXt, then any custom ancillary chunk), then EOF Append, then Alpha Channel, then Row Filter Encoding, then LSB in IDAT — matching the priority order real CTF challenges most commonly use. The first valid PNGSTEG header found wins.
Why didn't Auto Extract find my Row Filter Encoding payload?
Row Filter Encoding only works on non-interlaced PNGs up to 512×512 — if the file is larger, interlaced, or was re-saved/re-compressed by any other tool after encoding (which rewrites every scanline's filter choice), the payload is gone. This is the most fragile of the 5 methods by design.
Can this decode files from zsteg, pngcheck, or other PNG tools?
This tool's own PNGSTEG v1 header is only written by the companion PNG Steganography Hider, so auto-detect won't fire on files from other tools. Switch to Forensic mode and use Brute-Force — it scores every ancillary chunk and the EOF region for printable/CTF-flag content without requiring a header.
Why does it say 'header found — incorrect password'?
A valid PNGSTEG header was located, and its flags confirm the payload is AES-256-GCM encrypted, but decryption failed — the password field was left blank or doesn't match what was used during encoding. Enter the correct passphrase and try again.
The chunk list shows non-standard chunks but nothing decodes — why?
A non-standard ancillary chunk (lowercase first letter) doesn't guarantee it's steganography — it could be from an unrelated tool, or the data inside doesn't follow this tool's own wire format. Use the Full Chunk List panel (Forensic mode) to inspect it manually, or try Brute-Force to score its content.
Does the extractor modify my file?
No — reading a PNG's chunks and EOF bytes never modifies the file. Only the Alpha Channel and LSB in IDAT surfaces require decoding pixels (via Canvas), and that's a read-only operation on this tool's own copy in memory; your original upload is never altered.
Related Tools
PNG Steganography Hider
Hide text or files in a PNG using PNG-native methods: Chunk Injection (tEXt/iTXt/zTXt/custom), EOF Append, Alpha Channel, Row Filter Encoding, and LSB in IDAT. Chunk viewer, auto-verify, AES-256-GCM, Reed-Solomon, batch watermarking.
Image Steganography Extractor
Extract hidden messages from steganographic image files. Auto-detect mode, bit plane analysis.
Steganography Detector
Statistical steganalysis using four algorithms — chi-square, RS analysis, sample pairs, primary sets. StegExpose-equivalent. Payload size estimate. Method fingerprint. WAV audio support. No upload.