Steganography Detector
Statistical steganalysis with three published tests — chi-square, RS analysis and Sample Pairs — fused into one score and checked against the real StegExpose on a small test set. Payload size estimate. Method fingerprint. WAV audio support. Processed in your browser, not uploaded.
🔍 You can't see what's hidden by looking at it.
Statistical analysis can. Three published statistical tests — chi-square, RS analysis and sample pairs — look for the fingerprint that LSB embedding leaves behind.
Try the demo instantly
Loads a 300×300 gradient PNG for analysis — no upload needed
Aperi'Solve and most online steganalysis tools upload your files to their servers. This tool runs entirely in your browser via OffscreenCanvas, Web Crypto API, and WebWorkers. For forensic evidence with chain-of-custody requirements — this is the only browser option.
How to Detect Steganography in an Image (5 steps)
- Upload a suspicious image (PNG, BMP, JPEG) or WAV audio file
- Three statistical tests run automatically — chi-square, RS analysis and Sample Pairs
- Fusion score above 0.7 = HIGH, 0.4–0.7 = MEDIUM, below 0.4 = LOW (calibrated on a small set, see the measured table)
- See payload estimate (approximately how many bytes are hidden) and likely method used
- Download the forensic report for investigation documentation
Three Statistical Detection Tests — Comparison
| Algorithm | Best For | Payload Estimate? | Reliability |
|---|---|---|---|
| Chi-Square Attack | Sequential LSB over most of the image | No — probability only | Near a complete overwrite only: 0.00 at 10–50 % random fill in our test |
| RS Analysis | Random-bit LSB in PNG/BMP | Yes — estimate | About 0.14 of LSBs modified at 25 % fill (about 0.125 expected) |
| Sample Pairs | Random-bit LSB, partial fill | Yes — estimate | 0.00 / 0.10 / 0.25 / 0.50 at 0 / 10 / 25 / 50 % fill; agrees with StegExpose |
| Fusion (3 tests) | Random-bit LSB | Yes — range from RS and Sample Pairs | Mean of the three tests, scaled; calibrated on 8 crops of one photograph |
Measured Against the Real StegExpose
The same 40 images went through the real StegExpose program and through this tool: 8 crops of one photograph, clean and with random-bit LSB replacement at four fill levels. StegExpose flags a file when its mean score is above 0.2. This tool's score is 0–100 (LOW below 41, MEDIUM 41–70, HIGH above 70). It is a small test on one photograph, not an accuracy figure.
| Fill (random bits) | StegExpose flagged | StegExpose mean score | This tool LOW / MEDIUM / HIGH | This tool mean score |
|---|---|---|---|---|
| 0 % (clean) | 0 of 8 | 0.009 | 8 / 0 / 0 | 5 |
| 10 % | 0 of 8 | 0.081 | 8 / 0 / 0 | 20 |
| 25 % | 4 of 8 | 0.201 | 0 / 8 / 0 | 46 |
| 50 % | 8 of 8 | 0.342 | 0 / 0 / 8 | 91 |
| 100 % | 8 of 8 | 0.765 | 0 / 0 / 8 | 100 |
The Sample Pairs estimate agrees with StegExpose's own Sample Pairs value to within 0.003 on average over the 32 files at 0, 10, 25 and 50 % fill (it is left out at 100 %, where the estimate is saturated and StegExpose itself gives NaN or erratic values). This tool implements three of StegExpose's four tests: chi-square, RS analysis and Sample Pairs. It does not implement Primary Sets.
Frequently Asked Questions
What is the difference between this tool and the Steganography Analyzer?
The Steganography Analyzer focuses on extraction — 'What is hidden and can I extract it?' The Steganography Detector focuses on detection — 'Is something hidden, how much, and what method?' The detector provides probability scores, payload size estimates, and method fingerprints but does not extract the payload. Use the detector first to determine whether a file is suspicious, then use the appropriate extraction tool.
How accurate is the detection score?
The fusion score is the mean of three tests (chi-square p-value, RS estimate, Sample Pairs estimate), scaled so a mean of 0.40 reads as 100. We measured it against the real StegExpose on 40 images (8 crops of one photograph, clean and with random-bit LSB replacement at 10, 25, 50 and 100 % fill): every clean crop was LOW, 10 % fill LOW, 25 % MEDIUM, 50 % and 100 % HIGH, while StegExpose flagged none of the clean or 10 % files, half of the 25 % files and all of the 50 % and 100 % files. That is a small test on one photograph and one embedding style. No false-positive rate or accuracy for other images has been measured; adaptive methods (HILL, WOW, UNIWARD) and small payloads are expected to evade these tests.
Does this tool upload my files?
No. All analysis runs entirely in your browser using OffscreenCanvas, Web Crypto API, and WebWorkers. No network requests are made during analysis, so your file is not sent to a server. The page does not provide a chain-of-custody guarantee.
How does the payload size estimate work?
RS Analysis and Sample Pairs each estimate how much of the image carries data. Sample Pairs counts adjacent value pairs and solves a quadratic for the message length as a share of the samples; RS Analysis compares how a small flip of the lowest bits changes the smoothness of pixel groups. The tool shows the range between the two estimates, widened by 15 %. On our test set the Sample Pairs estimate matched the true fill and RS read about half of it as the share of modified LSBs. These are estimates from one photograph and one embedding style, not a guaranteed margin; JPEG estimates are less reliable because lossy compression changes the pixel values.
What is method fingerprinting?
After the tests run, the tool looks at which tests triggered and on which channels, and suggests a likely kind of embedding (for example sequential or randomised LSB). This is a rule of thumb from the test pattern, not an identification of a particular program, and it has not been checked against files made by other tools.
Can this tool detect steganography in WAV audio?
Partly. For 16-bit PCM WAV the tool runs Sample Pair Analysis on the sample values and reports the estimate and the lowest-bit balance. On 14 macOS system sounds with random-bit LSB replacement the estimate read 0.006 on clean files and 0.10, 0.26, 0.50 and 0.95 at 10, 25, 50 and 100 % fill, and the audio verdict (estimate of 0.08 or more) flagged none of the 14 clean files, 13 of 14 at 10 % fill and all 14 from 25 % fill up, so a small payload can be missed. Chi-square on the low byte and the lowest-bit balance are shown but not used for the verdict: they misfired on clean recordings. Results were checked on one kind of audio only.
Why is JPEG analysis less reliable?
JPEG's lossy compression quantizes pixel values, destroying the precise LSB statistics that chi-square and RS analysis rely on. Steganography in JPEG typically works in the DCT coefficient domain (JSteg, F5, Steghide) rather than the spatial LSB domain. The detector runs DCT coefficient analysis for JPEG files, but this is less mature than the spatial LSB tests. PNG and BMP analysis is significantly more reliable.
What should I do if the fusion score is in the MEDIUM range (0.4–0.7)?
A MEDIUM score means one or more tests moved away from the clean range, but not enough for HIGH. In our test it was typical of about a quarter of the pixels carrying random LSB bits. It can also mean a small payload, an adaptive method that partly evades the tests, or an image with unusual statistics. Examine the bit plane viewer, check the end of the file for trailing data, and try the extraction tools to see whether a payload can be recovered.
How does batch analysis work?
Drop up to 10 files (images or WAV, 20 MB each). Analysis runs in parallel using a WebWorker pool sized to your CPU cores. Results are sorted by detection score descending — highest-risk files appear first. Export a CSV report compatible with SIEM tools (Splunk, QRadar, Microsoft Sentinel) for security operations workflows.
Is this a StegExpose replacement?
Not a replacement. This tool implements three of StegExpose's four tests (chi-square, RS analysis, Sample Pairs) and averages them the way StegExpose does, but it does not implement the Primary Sets test, uses its own scale and thresholds, and runs in the browser. On 40 test images its Sample Pairs value agreed with StegExpose's to within 0.003 on average (excluding the saturated 100 % set) and it ranked the fill levels the same way; the table above shows both tools side by side. It has not been compared on other images, other tools' output or JPEG.
What steganography methods can this tool detect?
The tests respond to LSB replacement in pixel values, and we measured that with random bits in PNG crops (clean, 10, 25, 50 and 100 % fill). We did not test files made by named programs such as OpenStego, SilentEye or Steghide, so we do not claim detection for them. Adaptive methods (HILL, WOW, UNIWARD), methods that work in JPEG coefficients, and very small payloads are expected to evade these tests; GPU-based detectors such as Aletheia are aimed at those.
Related Tools
Steganography Analyzer
Deeper forensic investigation of this file — bit-plane viewer across every channel, EOF and metadata inspection, and a full forensic report to confirm where and how data may be hidden.
zsteg Online
If the method fingerprint points to LSB steganography, scan every bit/channel/order combination in this PNG or BMP for the exact hidden payload.
StegSolve Online
Manually inspect the file yourself — bit-plane visualization, color-channel isolation, and image transformations to spot what the statistics alone can't show.
Polyglot File Analyzer
If the file structure itself looks suspicious, check for multiple file signatures, trailing data, or a polyglot file hiding a second format entirely.