PNG Steganography Extractor
Extract hidden data from PNG steganography — chunk inspection, EOF scan, alpha channel, row filter analysis, and LSB in IDAT. PNGSTEG v1 auto-detect across all 5 surfaces, brute-force scoring, AES-256-GCM decryption, CTF flag detector.
Try the demo instantly
Loads a stego PNG with a hidden message already embedded in a tEXt chunk — auto-extracts instantly
Drop a PNG here, or click to browse
PNG only — chunk architecture is PNG-specific
Processed in your browser
Your PNG is processed in this browser tab, in a Web Worker, and is not sent to a StegoToolkit server. Basic usage analytics record coarse facts such as file type and size range, never the file or your payload.
How to Extract PNG Steganography (5 steps)
- Upload the PNG file to check (up to 50 MB). The tool scans it for this site's PNGSTEG header while you configure.
- Click Auto Extract — it tries Chunk Injection, EOF Append, Alpha Channel, Row Filter Encoding and LSB in IDAT in that order and stops at the first valid header.
- For a PNG made by another tool: switch to Forensic mode and run Brute-Force, which scores the non-standard chunks and the bytes after IEND for readable text.
- Enter the password if the payload was encrypted.
- Copy the decoded text or download the hidden file.
What This Extractor Reads
This extractor reads the five places the PNG Steganography Hider writes: an ancillary chunk (tEXt, iTXt, zTXt or a custom type), the bytes after the IEND chunk, the red value of fully transparent pixels, the parity of scanline filter-type bytes, and the lowest bit of R, G, B in raster order. In each place it looks for an 18-byte PNGSTEG header, so Auto Extract recovers files made by the Hider with no settings, and nothing else: a PNG from another tool has no such header, so the automatic scan finds nothing in it.
For other tools' files the useful part is Forensic mode: the full chunk list (type, length, standard or non-standard) and Brute-Force, which looks at every non-standard chunk and at the bytes after IEND and ranks them by how much readable text they contain. It does not read pixel bits, which is why LSB layouts from other tools need the LSB Extractor instead.
How Auto Extract Decides
The scan order is fixed: chunk → eof → alpha → row-filter → lsb. The first surface that holds a header with a valid CRC-32, version 1 and no reserved bits set wins; the CRC-32 is an integrity check, not authentication, and a header with unsupported values is not trusted. With a valid header the payload is decrypted if the header says so (a missing or wrong password is reported as such and no bytes are shown), then inflated and, if Reed-Solomon was used, repaired, then classified as text, a file type or binary data.
Quick and Standard run this scan. Forensic adds the choice of Auto, Manual or Brute-Force, forcing one method, the full chunk list and the decoy decode.
Brute-Force Mode for Header-less Files
Brute-Force does not run automatically after Auto Extract fails. When no header is found, switch to Forensic mode and run it yourself: it lists every non-standard chunk and the bytes after IEND with a score: 60 times the share of printable characters, plus 40 if the first 512 bytes contain a flag shape such as flag{, CTF{, HTB{, THM{ or picoCTF{. In our tests it surfaced a header-less tEXt chunk holding a flag, and it found no candidates in a clean PNG. A score is a ranking heuristic, not a probability: any chunk with printable bytes gets a score, and binary data, encrypted data and pixel-domain data score low or are not looked at.
When PNG Extraction Fails
Work down this list. (1) Is it the original file? A plain re-save with another program removed Chunk Injection, EOF Append, Row Filter and Alpha data in all 8 of our test photographs, and JPEG conversion or resizing removed everything including LSB in IDAT; if you only have a re-saved copy the data may be gone. (2) Was it made by the PNG Steganography Hider? If not, use Brute-Force for text in chunks or after IEND, the LSB Extractor for pixel bits, and the PNG Chunk Analyzer to read every chunk. (3) A password failure after a header was found means the header says the payload is encrypted and decryption failed. (4) Row Filter data needs a non-interlaced PNG up to 512 × 512 that has not been re-saved. (5) A non-standard chunk that decodes to nothing may belong to another tool or have a different format; inspect it in the full chunk list.
PNGSTEG v1 Header (18 bytes, big-endian)
Found at the start of the stored data in every method. Bytes 0–13 are covered by the CRC-32.
| Bytes | Field | Values |
|---|---|---|
| 0–3 | Magic | 'PSTG' |
| 4 | Version | 1 |
| 5 | Flags | bit 0 encrypted, bit 1 compressed, bits 2–3 Reed-Solomon level (0 none, 1 RS-10, 2 RS-20, 3 RS-30); other bits 0 |
| 6–7 | Method | 0 chunk, 1 EOF, 2 alpha, 3 row filter, 4 LSB |
| 8–11 | Stored length | bytes after the header |
| 12–13 | Reserved | 0 |
| 14–17 | CRC-32 | of bytes 0–13 |
Does the Hidden Data Survive a Conversion? (our test)
A 12-byte message hidden with the PNG Hider in 8 photograph crops (400 × 300 from one photograph; the Alpha Channel row uses the same crops with 40% made fully transparent, so it is synthetic), converted with the macOS system image tool (sips) and read with Auto Extract. Other programs, encoders and individual websites or apps were not tested.
| Method | PNG → PNG re-save | BMP / TIFF round trip | JPEG q100 / q75 | Resize to 90% |
|---|---|---|---|---|
| Chunk Injection, EOF Append, Row Filter, Alpha | 0 of 8 | 0 of 8 | 0 of 8 | 0 of 8 |
| LSB in IDAT | 8 of 8 | 8 of 8 | 0 of 8 | 0 of 8 |
Examples
Input: A PNG made by the PNG Steganography Hider with Chunk Injection (tEXt) holding 'Hello world round trip'
Result: Auto Extract finds the header in the tEXt chunk and returns the 22 bytes as text.
Meaning: The header carried the method, so no setting was needed.
Input: A PNG with a plain tEXt chunk 'Comment: flag{png_text_chunk_secret}' and no PNGSTEG header
Result: Auto Extract finds nothing. In Forensic mode Brute-Force lists the tEXt chunk as a candidate with the flag text in its preview.
Meaning: Brute-Force reads chunks and bytes after IEND without needing this tool's header.
Input: A clean photograph saved as PNG
Result: Auto Extract reports that no header exists; Brute-Force finds no candidates.
Meaning: The tool does not call anything a find without a valid header or readable text in a chunk or after IEND.
Input: An encrypted PNGSTEG file and the wrong password
Result: The incorrect-password message appears and no bytes are shown.
Meaning: The header was found and read; AES-GCM authentication failed.
How the PNG Extractor Works
1. Parse the PNG
The file is split into chunks in a Web Worker; the bytes after IEND are kept separately. Nothing is uploaded.
2. Look for a header
Each surface is tried in the fixed order; pixel surfaces are decoded only when reached.
3. Validate
A header counts only with the magic, version 1, no reserved bits and a matching CRC-32.
4. Decrypt, repair, inflate
As the header's flags say; a wrong password stops here with a message.
5. Classify and show
Text, a known file type or binary data, with flag patterns highlighted.
What the results mean
| Result | What it means | What to do |
|---|---|---|
| Success screen with the payload | A valid PNGSTEG header was found and the payload decoded | Copy or download it |
| Password failure after a header was found | The header says encrypted and decryption failed | Check the password; a forgotten one cannot be recovered |
| Nothing on any of the five surfaces | None of the five surfaces holds this tool's header | Try Brute-Force (Forensic), or another extractor for pixel-domain data |
| Candidate list without a payload | Brute-Force found chunks or trailing bytes with readable text but no header | Read the previews; the data follows another tool's format |
Limitations
- The PNGSTEG format does not store file names. A hidden file comes back as bytes: the download button names it after the carrier PNG (with its real extension when the type is recognised, .txt for text, otherwise .bin), and unrecognised binary data can still be downloaded as .bin.
- The Extractor opens PNG files up to 50 MB. That limit applies to the file you open, including a PNG made by the Hider, so the Hider refuses to produce a larger file. It is not a payload limit: the hidden data the Hider can store is smaller, and depends on the method and the image (see the Hider's capacity section).
- Auto Extract only recognises files made by this site's PNG Steganography Hider; other tools' output needs Brute-Force, another extractor, or manual analysis.
- Brute-Force reads chunks and the bytes after IEND only; it does not read pixel bits, and its score is a ranking heuristic.
- Any re-save, conversion or resizing of the PNG can remove the data: in our tests a plain re-save removed every method except LSB in IDAT. Other programs and websites were not tested.
- Row Filter data needs a non-interlaced PNG up to 512 × 512 that has not been re-saved.
- Reading never modifies your file; pixel methods decode a copy in memory.
Privacy
Your PNG and password are processed in your browser, in a Web Worker, and are not sent to a StegoToolkit server by the tool's own code. The only things the tool keeps in your browser are your chosen mode (localStorage) and a flag that you dismissed the mobile tip. Site analytics, if you accept them, may record coarse facts such as the detection mode, the file type, a size range and timing — never the image, extracted data, password or file name. The hosting provider's ordinary request logs still record your visit.
Which Tool Next?
- PNG Steganography Hider — Hide data with the layout this Extractor reads automatically
- zsteg Online — Scan any PNG or BMP for hidden LSB data across many channel and bit combinations, no header needed
- LSB Extractor — Read LSB bits and bit planes of any image, header or not
- PNG Chunk Analyzer — Inspect every chunk and its data
- Steganography Detector — Test whether an image looks modified
Frequently Asked Questions
How do I find hidden data in a PNG file?
Open the PNG here and click Extract. Auto Extract checks the five places this site's PNG Hider writes to (chunks, bytes after IEND, alpha channel, row filters, LSB in IDAT) and reads the result when it finds a PNGSTEG header. For a file from somewhere else, switch to Forensic mode: the chunk list shows every chunk, and Brute-Force scores the non-standard chunks and the bytes after IEND by how readable they are. To look for hidden bits in the pixel colour values of any PNG, use the zsteg Online scanner; for a plain chunk-by-chunk view use the PNG Chunk Analyzer.
How is this different from the zsteg tool on this site?
zsteg Online scans any PNG or BMP for LSB data across many bit, channel and pixel-order combinations, with or without a header. This Extractor reads the specific places the PNG Steganography Hider writes (tEXt, iTXt, zTXt and custom chunks, bytes after IEND, alpha channel, row filters, and LSB in IDAT with a PNGSTEG header) and can score header-less chunks. For an unknown CTF image, start with zsteg Online or the PNG Chunk Analyzer.
What order does Auto Extract scan surfaces in?
Chunk Injection first (tEXt, iTXt, zTXt, then custom ancillary chunks), then EOF Append, Alpha Channel, Row Filter Encoding and LSB in IDAT. The first surface holding a valid PNGSTEG header wins. The order is fixed in the code; it is not based on how often each method appears in challenges.
Why didn't Auto Extract find my Row Filter Encoding payload?
Row Filter Encoding works only on non-interlaced PNGs up to 512 × 512 that have not been re-saved: any program that rewrites the image data chooses its own filter types and removes the bits. In our tests a plain re-save removed it in all 8 photographs.
Can this decode files from zsteg, pngcheck or other PNG tools?
Only partly. Auto Extract needs this tool's PNGSTEG header, which only the PNG Steganography Hider writes. For a header-less file use Forensic mode and Brute-Force, which ranks non-standard chunks and the bytes after IEND by readable text. It does not read pixel bits; use the LSB Extractor for those.
What does the incorrect-password message mean?
A valid header was located and its flags say the payload is AES-256-GCM encrypted, but decryption failed: the password was left blank or does not match. No bytes are shown. A forgotten password cannot be recovered.
The chunk list shows non-standard chunks but nothing decodes — why?
A non-standard ancillary chunk (lowercase first letter) is not proof of steganography: it may come from another tool or follow another format. Inspect it in the full chunk list (Forensic mode), run Brute-Force to score its content, or open it in the PNG Chunk Analyzer.
Does the extractor modify my file?
No. Chunks and bytes after IEND are only read; Alpha Channel and LSB in IDAT decode pixels from a copy held in memory. Your original file is not changed.
Is my PNG uploaded to any server?
The tool's own code does not upload your PNG or password: extraction runs in a Web Worker in your browser. Accepted analytics may record coarse option choices, file type, size range and timing, but never the image, extracted data, password or file name, and your host's ordinary request logs still see the page visit.
Related Tools
PNG Steganography Hider
Hide text or files in a PNG using methods built on the PNG file layout: Chunk Injection (tEXt/iTXt/zTXt/custom), EOF Append, Alpha Channel, Row Filter Encoding, and LSB in IDAT. Chunk viewer, auto-verify, AES-256-GCM, Reed-Solomon, per-recipient batch watermarking (one uniquely marked file per recipient).
Image Steganography Extractor
Extract hidden messages from steganographic image files. Auto-detect mode, bit plane analysis.
Steganography Detector
Statistical steganalysis with three published tests — chi-square, RS analysis and Sample Pairs — fused into one score and checked against the real StegExpose on a small test set. Payload size estimate. Method fingerprint. WAV audio support. Processed in your browser, not uploaded.