PNG Steganography Hider
Hide text or files in a PNG using PNG-native methods: Chunk Injection (tEXt/iTXt/zTXt/custom), EOF Append, Alpha Channel, Row Filter Encoding, and LSB in IDAT. Chunk viewer, auto-verify, AES-256-GCM, Reed-Solomon, batch watermarking.
Try the demo instantly
Loads a 120×120 PNG with a transparent region — shows the chunk viewer and alpha capacity immediately
Drop a PNG here, or click to browse
PNG only — chunk architecture is PNG-specific
100% Client-Side Processing
Your PNG is processed entirely in this browser tab. Nothing is uploaded to any server.
How to Hide Data in a PNG (5 steps)
- Upload a PNG image as the carrier
- Type your secret message or upload a file to hide
- Add a passphrase for AES-256-GCM encryption (recommended)
- Switch to Standard or Forensic to pick Chunk Injection, EOF Append, Alpha Channel, Row Filter Encoding, or LSB in IDAT
- Click Embed — the output is auto-verified before download
PNG Steganography — 5 Methods Compared
| Method | Surface | Capacity | Best For |
|---|---|---|---|
| Chunk Injection | tEXt / iTXt / zTXt / custom ancillary chunk | Unlimited (memory-limited) | Reliable file transfer, watermarking, CTF challenges |
| EOF Append | Bytes after the IEND chunk | Unlimited (memory-limited) | Quick hiding — simple and fast |
| Alpha Channel | RGB values of fully-transparent (α=0) pixels | transparentPixels / 8 bytes | Maximum stealth (Chrome/Edge — browser-dependent) |
| Row Filter Encoding | Scanline filter-type byte (0=None…4=Paeth) parity | height / 8 bytes, max 512×512 | ⚠ Experimental — CTF/research, very fragile |
| LSB in IDAT | Pixel LSBs (standard, zsteg-compatible) | ≈ pixels × 3 / 8 bytes | Cross-tool compatibility (zsteg, stegsolve) |
Frequently Asked Questions
Why is this different from the Image Steganography Hider?
The Image Steganography Hider does generic pixel LSB across any image format. This tool exploits PNG's own file structure specifically — its chunk architecture (tEXt/iTXt/zTXt/custom ancillary chunks), the EOF space after IEND, and alpha-channel transparency. These methods only exist because of how PNG files are built, and 3 of the 4 (Chunk Injection, EOF Append) leave zero pixel change — PSNR: ∞.
Which method should I use?
For reliable file transfer or long-term storage: tEXt/iTXt/zTXt chunk injection (95% survival rate, zero pixel change). For quick hiding: EOF append (also 95%, even simpler). For maximum stealth on Chrome/Edge: alpha channel — but it's browser-dependent and unreliable on Safari/mobile. For zsteg-compatible CTF challenges: LSB in IDAT — but it's destroyed by any re-compression (10-30% survival).
Will the hidden data survive social media uploads?
No. Twitter/X, Discord image uploads, and WhatsApp all re-encode PNGs, stripping ancillary chunks and re-compressing IDAT — destroying every method here. Email attachments, Google Drive, Dropbox, and Telegram file shares (not image uploads) preserve the file byte-for-byte.
What's the Canvas Reconstruction Warning about?
Alpha Channel and LSB in IDAT both decode and re-encode the PNG through Canvas to access pixel data — this strips existing ancillary chunks (tEXt, iTXt, iCCP) and changes IDAT compression, even though your embedded payload survives. If preserving the original file's other metadata matters, use Chunk Injection or EOF Append instead — both operate on raw bytes with zero re-encoding.
What's the PNGSTEG v1 header for?
Every encode embeds an 18-byte, big-endian PNGSTEG v1 header (magic, version, flags, method, payload length, CRC32) alongside the payload. The PNG Steganography Extractor auto-detects this header across all 5 surfaces — zero configuration needed to decode a file this tool produced.
What is auto-verify?
After embedding, this tool automatically decodes its own output and compares the SHA-256 hash of the recovered payload against the original — before showing you a download button. If verification fails (rare — usually an image too small for the payload), you'll see a clear error instead of a silently corrupted file.
How does Row Filter Encoding work, and why is it marked experimental?
Every PNG scanline stores a 1-byte filter type (None/Sub/Up/Average/Paeth) chosen by the original encoder to help compression. Defiltering always recovers identical pixel values regardless of which filter type produced the bytes — so choosing an even or odd filter type per row can carry a payload bit with truly zero pixel change. It's experimental because it's fragile: limited to 512×512 images (real memory/CPU cost of a full inflate/defilter/refilter/deflate pass), doesn't support interlaced PNGs, and any tool that re-saves or re-compresses the file (including this tool's own Alpha Channel/LSB methods, which decode via Canvas) will destroy it.
What's IHDR dimension manipulation?
A Forensic-mode-only CTF flourish, not a hiding method on its own — it deliberately writes wrong width/height into the IHDR chunk (with a valid, recomputed CRC32) while leaving the real pixel data untouched, so most viewers render the file broken or garbled. It's layered on top of Chunk Injection or EOF Append (the two methods whose own decode doesn't depend on the file's reported dimensions) — Alpha Channel, Row Filter Encoding, and LSB in IDAT are incompatible with it, since decoding those requires knowing the image's TRUE dimensions.
Related Tools
PNG Steganography Extractor
Extract hidden data from PNG-native steganography — chunk inspection, EOF scan, alpha channel, row filter analysis, and LSB in IDAT. PNGSTEG v1 auto-detect across all 5 surfaces, brute-force scoring, AES-256-GCM decryption, CTF flag detector.
Image Steganography Hider
Hide secret messages or files inside PNG, BMP, or JPG images. AES-256 encrypted, 100% client-side.
Steganography Capacity Calculator
Calculate exact hidden-payload capacity for PNG, BMP, WebP, WAV, FLAC, AIFF and more — plus PSNR and detection risk, all client-side. Links to the right specialist hider/extractor for your file type.