Steghide Online Extractor
Extract data hidden by steghide (or by this tool) from a JPEG, WAV, AU, or BMP — same passphrase-seeded position selection, AES-256-CBC decryption, and CRC32 checksum verification as the real steghide CLI. Cross-checked against a real compiled steghide binary. 100% client-side, no upload.
Try the demo instantly
Loads a JPEG with a hidden message already embedded (no passphrase)
Drop your JPEG, WAV, AU, or BMP here or click to browse
.jpg / .jpeg / .wav / .au / .bmp · Max 50 MB
Parsed locally in your browser — nothing uploaded
100% Client-Side — Real Steghide Algorithm
A from-scratch TypeScript port of steghide's own graph-matching embedding for JPEG (DCT coefficients), WAV/AU (PCM/mu-law samples), and BMP (1-bit/4-bit palette indices), verified against official crypto test vectors and cross-checked against a real compiled steghide binary. Your file never leaves this tab.
How to Extract Hidden Data from a Steghide JPEG, WAV, AU, or BMP (4 steps)
- Upload the suspected JPEG (.jpg/.jpeg), WAV (.wav), AU (.au/.snd), or BMP (.bmp, 1-bit/4-bit palette) — steghide's algorithm only works on these carrier formats.
- On the Extraction Settings step, switch to Forensic mode for a one-click auto-try of 55 common CTF passphrases, or stay on Quick/Standard if you already know the passphrase.
- Enter the passphrase on the Decrypt & Extract step (leave blank to try no passphrase) and click 'Extract Hidden Data'.
- Review the result — text is shown inline, files get a direct download, and a CRC32 checksum (if one was embedded) confirms the extracted bytes are intact.
Steghide Algorithm — Overview
| Method | Technique | Detectability | Best For |
|---|---|---|---|
| Steghide graph-matching (DCT/PCM) | Reads sample parity across passphrase-selected positions — no graph/matching needed for extraction, only for embedding | N/A (extraction only reads existing values) | Recovering payloads from real steghide-format JPEGs, WAVs, AUs, and BMPs, CTF challenges |
Frequently Asked Questions
I entered the passphrase and it says no data was found — why?
A wrong passphrase produces a completely different position permutation, so the magic-byte check almost always fails immediately — this matches real steghide's own "could not extract any data with that passphrase!" behavior. Try Forensic mode's CTF auto-try, double-check for typos/whitespace, or confirm the file actually uses steghide (not a different steganography tool like F5, JSteg, or OutGuess for JPEG).
This JPEG was made with the real steghide CLI and won't extract here — is that a bug?
No — this used to be a known gap (a coefficient-ordering mismatch between this port's JPEG library and real steghide's own libjpeg-based writer) but it's been found and fixed, confirmed via a real compiled steghide binary in both directions. If extraction still fails, it's a wrong passphrase, a non-default cipher, or the file wasn't made with steghide at all.
What does the CTF auto-try actually do?
It tries the empty passphrase first, then 55 common CTF passphrases (from CTFtime writeup analysis — tool names, common words, simple patterns) against the real extraction pipeline, stopping at the first one whose magic bytes match. It runs entirely in your browser; nothing is sent anywhere.
The checksum says 'Mismatch' — is my data corrupted?
The payload was still fully extracted, but its CRC32 doesn't match what was embedded — usually because the file was re-compressed, re-saved, or transcoded by another program after embedding (which changes the carrier's DCT coefficients or PCM samples), corrupting the embedded data. The bytes shown may be partially wrong.
Why can't this extract a file made with real steghide's RC4/ARCFOUR option?
This port decodes the default cipher (Rijndael-128/CBC = AES-256-CBC) plus DES, Triple-DES, Blowfish, RC2, CAST-128, Twofish, Serpent, XTEA, SAFER SK-64, SAFER SK-128, SAFER+, CAST-256, 3-WAY, GOST, Rijndael-192, Rijndael-256, LOKI97, and Enigma (`-e des`/`-e tripledes`/`-e blowfish`/`-e rc2`/`-e cast-128`/`-e twofish`/`-e serpent`/`-e xtea`/`-e safer-sk64`/`-e safer-sk128`/`-e safer+`/`-e cast-256`/`-e 3-way`/`-e gost`/`-e rijndael-192`/`-e rijndael-256`/`-e loki97`/`-e enigma`) — detected automatically from the file, no need to specify which one. Real steghide supports 22 non-default algorithms in total; a file encoded with any of the remaining ones (RC4/ARCFOUR, WAKE, or PANAMA) can't be decrypted here yet — the tool reports a clear "unsupported encryption algorithm" error rather than silently returning garbage.
This isn't steghide data — what else can I try?
If the file isn't steghide-encoded, try this site's general JPEG Steganography tool (F5/JSteg/metadata methods) or Audio/WAV Steganography tool for other embedding methods, the Steganography Analyzer for a broader statistical scan, or the Steganography Detector for method fingerprinting.
Is this the same as Stegseek or Stegcracker — can it brute-force a password?
Not fully. Forensic mode's CTF auto-try checks the empty passphrase plus 55 common CTF passphrases against the real extraction pipeline — enough to solve many CTF challenges instantly, entirely in your browser. Stegseek and Stegcracker are dedicated wordlist-attack tools built for exhaustive brute-forcing (millions of candidates per second against the CRC check) — this tool doesn't attempt that. If the 55-password auto-try doesn't find it and you don't know the passphrase, a dedicated brute-force tool against a real wordlist is the next step.
Related Tools
Steghide Online
Hide text or files inside a JPEG, WAV, AU, or BMP using a faithful client-side port of the real steghide algorithm — graph-theoretic minimum-distortion matching, AES-256-CBC encryption, and the same passphrase-seeded position selection real steghide uses. Cross-checked against a real compiled steghide binary. 100% client-side, no upload.
Steganography Detector
Statistical steganalysis using four algorithms — chi-square, RS analysis, sample pairs, primary sets. StegExpose-equivalent. Payload size estimate. Method fingerprint. WAV audio support. No upload.