Steganography Analyzer
Deep forensic investigation of a suspicious image — bit plane viewer across every channel, EOF/metadata inspection, and a chain-of-custody forensic report. Where and how is it hidden? No upload.
Most online steganalysis tools (including Aperi'Solve) upload your files to their servers. This tool runs entirely on your device using Canvas API, Web Crypto API, and WebWorkers. For forensic evidence, corporate secrets, or sensitive content — this matters.
Try the demo instantly
Loads a sample image — no upload needed
How to Detect Hidden Data in an Image (5 steps)
- Upload the suspicious image (PNG, BMP, JPEG, GIF, or WebP)
- Three statistical tests (chi-square, RS analysis, Sample Pairs) run automatically in your browser — no upload
- Review the Suspicion Score (0–100) with per-method breakdown
- Examine bit planes visually for LSB noise patterns
- Download the forensic JSON report for chain-of-custody documentation
Three Statistical Detection Tests — Comparison
| Method | Best For | Payload Estimate? | Accuracy |
|---|---|---|---|
| Chi-Square Attack | Sequential LSB over most of the image | No — probability only | Reads high only near a complete overwrite: 0.00 at 10–50 % fill in our test |
| RS Analysis | Random-bit LSB in PNG/BMP | Yes — estimate | About 0.14 of LSBs modified at 25 % fill (about 0.125 expected) |
| Sample Pairs | Random-bit LSB, partial fill | Yes — estimate | 0.00 / 0.10 / 0.25 / 0.50 at 0 / 10 / 25 / 50 % fill; matches StegExpose |
| Fusion (3 tests) | Random-bit LSB | Combined range | Mean of the three; calibrated on 8 crops of one photograph |
Measured Against the Real StegExpose
The same 40 images went through the real StegExpose program and through this tool: 8 crops of one photograph, clean and with random-bit LSB replacement at four fill levels. StegExpose flags a file when its mean score is above 0.2. This tool's score is 0–100 (LOW below 41, MEDIUM 41–70, HIGH above 70). It is a small test on one photograph, not an accuracy figure.
| Fill (random bits) | StegExpose flagged | StegExpose mean score | This tool LOW / MEDIUM / HIGH | This tool mean score |
|---|---|---|---|---|
| 0 % (clean) | 0 of 8 | 0.009 | 8 / 0 / 0 | 5 |
| 10 % | 0 of 8 | 0.081 | 8 / 0 / 0 | 20 |
| 25 % | 4 of 8 | 0.201 | 0 / 8 / 0 | 46 |
| 50 % | 8 of 8 | 0.342 | 0 / 0 / 8 | 91 |
| 100 % | 8 of 8 | 0.765 | 0 / 0 / 8 | 100 |
The Sample Pairs estimate agrees with StegExpose's own Sample Pairs value to within 0.003 on average over the 32 files at 0, 10, 25 and 50 % fill (it is left out at 100 %, where the estimate is saturated and StegExpose itself gives NaN or erratic values). This tool implements three of StegExpose's four tests: chi-square, RS analysis and Sample Pairs. It does not implement Primary Sets.
Frequently Asked Questions
Does this tool upload my files to any server?
No. All analysis runs entirely in your browser using Canvas API for pixel extraction, Web Crypto API for SHA-256 hashing, and WebWorkers for parallel computation. The network tab will show zero file upload requests. This is the only browser steganalysis tool with this guarantee.
What does the Suspicion Score mean?
The score (0–100) is the mean of three tests (the chi-square p-value, the RS estimate and the Sample Pairs estimate), scaled so that a mean of 0.40 reads as 100. Above 70 is HIGH, 41–70 MEDIUM, 40 or below LOW. On our test set (8 crops of one photograph, clean and with random-bit LSB replacement) every clean crop was LOW, 25 % fill was MEDIUM and 50 % and 100 % fill were HIGH. That is a small test on one photograph: no false-positive rate or accuracy has been measured, and results are probabilistic, so a HIGH score is not proof of hidden content.
How accurate is the payload estimate?
RS Analysis and Sample Pairs each estimate the message length as a share of the pixel values. The tool shows the range between the two, widened by 15 %. On our test set the Sample Pairs estimate matched the true fill (0.10, 0.25 and 0.50 for 10, 25 and 50 % random-bit fill); RS read about half of that as the share of LSBs modified. These are estimates from one photograph and one embedding style, not a guaranteed error margin. JPEG estimates are less reliable because lossy compression changes the pixel values.
Why is chi-square less reliable for JPEG?
Chi-square attack was designed for lossless steganography (PNG/BMP LSB replacement). JPEG's lossy compression quantizes pixel values, which disrupts the PoV pair statistics the test relies on. For JPEG files, RS analysis is more appropriate. The tool warns you when a JPEG is submitted.
What is the Bit Plane Viewer showing?
Each color channel (Red, Green, Blue) has 8 bit planes — one per bit. The LSB (Bit 0) plane is most important for steganalysis. In clean images, the LSB plane shows a structured, smooth noise pattern. In stego images, the LSB plane appears more random due to data being embedded in those bits.
What is the difference between this tool and Aperi'Solve?
Aperi'Solve runs zsteg, steghide, binwalk, and exiftool on their servers — your file is uploaded to a third-party service. This tool runs entirely in your browser; your file never leaves your device. Critical for forensic evidence (chain of custody), corporate security (confidential files), and legal material (attorney-client privilege).
What does 'EOF trailing data' mean?
Some steganography methods append data after the image's official end marker (JPEG FF D9, PNG IEND chunk). The EOF check detects this. Trailing data is a strong indicator of appended payload. Try the File Hider Extractor to attempt extraction.
Can this tool detect all types of steganography?
The statistical tests respond to LSB replacement in pixel values; we measured that with random bits in PNG crops of one photograph. Adaptive methods (HILL, WOW, UNIWARD) and DCT-domain methods (JSteg, F5) are expected to evade them because they preserve statistical properties, and so are very small payloads. Deep learning detectors such as Aletheia are aimed at those but need a GPU and Python. No coverage figure for real-world files has been measured.
How does batch analysis work?
Drop up to 50 files and click Analyze. Files are processed in parallel using a WebWorker pool (up to 8 concurrent workers, based on your CPU core count). Results are sorted by suspicion score so the most suspicious files appear first. Export a batch JSON report or SIEM-compatible CSV for Splunk, IBM QRadar, or Microsoft Sentinel.
Is the SHA-256 hash suitable for forensic documentation?
Yes. The SHA-256 hash is computed on your device using the Web Crypto API before analysis begins. It appears in the forensic JSON report alongside the timestamp. This provides chain-of-custody documentation: you can prove the file you analyzed had that exact hash at that time.
Related Tools
StegSolve Online
Full StegSolve.jar in your browser. 28 bit planes, auto-scan, chi-square LSB detection, brute-force extractor, PNG chunk analysis, stereogram solver. No Java, no install.
Polyglot File Analyzer
Detect multiple file formats hidden in one file — PNG+ZIP, JPEG+PDF, and more. Binwalk-compatible signature scan, byte map, extraction, and polyfile-style JSON report. No upload.
Steganography Detector
Statistical steganalysis with three published tests — chi-square, RS analysis and Sample Pairs — fused into one score and checked against the real StegExpose on a small test set. Payload size estimate. Method fingerprint. WAV audio support. Processed in your browser, not uploaded.
zsteg Online
zsteg-style LSB channel scanner for PNG and BMP. Scans every bit/channel/order combination and reports results in zsteg's exact output format. No Ruby, no install, no upload.