QR Code Steganography Extractor
Extract hidden payloads from steganographic QR codes. Auto-detects method across LSB, module color, and PNG metadata. Shows QR anomaly score and per-method results.
Drop QR code image or click to browse
PNG, JPEG, WebP, BMP — QR code images
100% Client-Side Analysis
QR scanning and stego extraction happen entirely in your browser. Your QR code image is never uploaded. PNG format gives the best accuracy.
How to Extract Hidden Data from a QR Code (5 steps)
- Upload the QR code image (PNG recommended; JPG reduces accuracy)
- The tool automatically scans the QR and shows its primary content
- Click Auto-Detect to try all extraction methods, or choose one manually
- If the payload is encrypted, enter the password to decrypt
- Copy your hidden message or download the extracted file
QR Extraction Methods — Detection Guide
| Method | Accuracy | Speed | Best For |
|---|---|---|---|
| Auto-Detect | Tries all methods | Fast | Unknown method — CTF challenges |
| PNG Metadata | Exact | Instant | Files encoded with metadata method |
| LSB Pixel | High (PNG only) | Fast | Files encoded with LSB method |
| Module Color | High | Fast | Files encoded with color method |
Frequently Asked Questions
How does Auto-Detect work?
Auto-Detect tries all 4 extraction methods in order: PNG Metadata → LSB Pixel → Module Color → Error Correction. It validates each result using entropy, magic bytes, and UTF-8 checks. The first method that returns readable data is highlighted as the best result.
What is the QR Anomaly Score?
A 0–100 score indicating the likelihood that this QR code contains hidden data. It combines four checks: PNG metadata anomalies (0–20), module color anomalies (0–25), LSB pattern entropy (0–25), and EC codeword deviations (0–30 — Phase 2).
Why does the anomaly score show high even when no payload is found?
Some QR codes contain natural artifacts that trigger anomaly checks — especially JPEG compression artifacts that create non-standard pixel values. Always verify with manual method selection before concluding steganography is present.
Can I extract data from a JPEG QR code?
LSB and Module Color methods may fail on JPEG images because JPEG compression alters pixel values. PNG Metadata extraction still works on JPEG (the tEXt chunk is unaffected by compression). Use PNG for best results.
What do CTF flags look like in results?
CTF flags matching common patterns (FLAG{...}, HTB{...}, picoCTF{...}, CTF{...}, etc.) are automatically highlighted in green with a one-click copy button.
What is Reed-Solomon recovery?
If the QR image was re-compressed or partially corrupted after encoding, RS Recovery Mode attempts to reconstruct the payload from the intact embedding positions. Enable this if standard decode returns garbled output.