Steghide Online Extractor
Extract data hidden by steghide (or by this tool) from a JPEG, WAV, AU, or BMP — same passphrase-seeded position selection, AES-256-CBC decryption, and CRC32 checksum verification as the real steghide CLI. Cross-checked against steghide 0.6.0 on synthetic covers: files from either tool extract correctly in the other. Processed in your browser, not uploaded.
Try the demo instantly
Loads a JPEG with a hidden message already embedded (no passphrase)
Drop your JPEG, WAV, AU, or BMP here or click to browse
.jpg / .jpeg / .wav / .au / .bmp · Max 50 MB
Parsed locally in your browser — nothing uploaded
Processed in your browser — Steghide-Compatible
A from-scratch TypeScript implementation of steghide's graph-matching embedding for JPEG (DCT coefficients), WAV/AU (PCM/mu-law samples), and BMP (palette indices or 24-bit RGB pixels), verified against official crypto test vectors and cross-checked against steghide 0.6.0 (files from either tool extract correctly in the other). Your file is processed in this tab and is not sent to a server; usage statistics may record which options were used, never your file or passphrase.
How to Extract Hidden Data from a Steghide JPEG, WAV, AU, or BMP (4 steps)
- Upload the suspected JPEG (.jpg/.jpeg), WAV (.wav), AU (.au/.snd), or BMP (.bmp, 1/4/8-bit palette or 24-bit RGB) — steghide's algorithm only works on these carrier formats.
- On the Extraction Settings step, switch to Forensic mode for a one-click auto-try of the empty passphrase plus 58 common words, or stay on Quick/Standard if you already know the passphrase.
- Enter the passphrase on the Decrypt & Extract step (leave blank to try no passphrase) and click 'Extract Hidden Data'.
- Review the result — text is shown inline, files get a direct download, and, if a CRC32 checksum was stored, it is compared with the extracted data to catch accidental corruption (a match is useful evidence, not a cryptographic guarantee).
Steghide Algorithm — Overview
| Method | Technique | Detectability | Best For |
|---|---|---|---|
| Steghide graph-matching (DCT/PCM) | Reads sample parity across passphrase-selected positions — no graph/matching needed for extraction, only for embedding | N/A (extraction only reads existing values) | Recovering payloads from real steghide-format JPEGs, WAVs, AUs, and BMPs, CTF challenges |
What this extractor can and cannot read
It reads files made with steghide (or with the matching Steghide Hider on this site): JPEG, WAV, AU and BMP files in which steghide's own stream was embedded. It does not read data hidden by other programs such as F5, JSteg, OutGuess or LSB tools; for those use the tools linked below.
Extraction needs the exact passphrase, because the passphrase decides which positions to read. A wrong passphrase gives a different position order, so the extractor almost always fails to find a valid steghide stream and says so, which is also what real steghide reports. A stream that is found is not proof the bytes are intact: check the CRC32 result and treat a mismatch as a warning.
Using the auto-try
In Forensic mode the extractor tries the empty passphrase and then 58 built-in words (steghide, password, secret, flag, ctf and similar) and stops at the first one that gives recognisable data. It only helps when the passphrase is one of those words, and it is not a Stegseek-style wordlist attack.
Examples
Input: A WAV file with the text "Meet at 9" hidden under the passphrase steghide, run through the auto-try.
Result: The auto-try finds the passphrase steghide on its second attempt (the empty passphrase is tried first) and shows the text.
Meaning: The passphrase was in the built-in list, so no manual typing was needed.
Input: The same kind of file hidden under a passphrase that is not in the list, run through the auto-try.
Result: All 59 passphrases are tried and none works, so the result says the passphrase was not found.
Meaning: Without the passphrase this tool cannot read the file; a dedicated wordlist tool against a large list is the next step.
How the Steghide Extractor Works
Rebuild the position order
The passphrase seeds the same pseudorandom permutation the Hider used, so the extractor reads the carrier's values in the same scattered order.
Read the bits and look for steghide's magic
The first bits must spell steghide's magic number. A wrong passphrase reads other positions and the check fails at once.
Decrypt, decompress, verify
The encryption parameters stored in the stream select the cipher, the data is decrypted and decompressed if needed, and the CRC32 is compared when one was stored.
What the results mean
| Result | What it means | What to do |
|---|---|---|
| Nothing was found | No recognisable steghide stream was read with that passphrase. It is either the wrong passphrase, a different tool, or a carrier that was changed after embedding. | Check the passphrase for typos and case, try the Forensic auto-try, or try the tools linked below. |
| A CRC mismatch is shown | The data was extracted but its CRC32 differs from the stored one, so some bytes may be wrong, usually because the file was re-encoded after embedding. | Treat the output as damaged; get the original stego file if you can. |
| An unsupported cipher message | The cipher id in the file is not one steghide defines. | The file is probably corrupt or not from steghide. |
Limitations
- Reads only steghide streams in JPEG, WAV, AU and BMP (1, 4, 8 or 24-bit) files; the upload limit is 50 MB (15 MB on phones).
- The auto-try covers 59 passphrases (the empty one plus 58 words); it is not a brute-force tool.
- A file changed after embedding (re-saved, resized, converted) usually cannot be read.
- Interoperability with real steghide 0.6.0 was tested on synthetic covers; real photos and recordings are covered by a separate optional script.
Privacy
The file and the passphrases you try are processed in this browser tab and are not sent to our server. Usage statistics may record which options were used (never the file or a passphrase), and our host keeps ordinary request logs.
Which Tool Next?
- Steghide Hider — to hide data with the same algorithm
- JPEG Steganography Extractor — for data hidden with F5 or JSteg
- Steganography Analyzer — for a broader scan when the method is unknown
Frequently Asked Questions
I entered the passphrase and it says no data was found — why?
A wrong passphrase produces a completely different position permutation, so the magic-byte check almost always fails immediately — this matches real steghide's own "could not extract any data with that passphrase!" behavior. Try Forensic mode's CTF auto-try, double-check for typos/whitespace, or confirm the file actually uses steghide (not a different steganography tool like F5, JSteg, or OutGuess for JPEG).
This JPEG was made with the real steghide CLI and won't extract here — is that a bug?
No — this used to be a known gap (a coefficient-ordering mismatch between this port's JPEG library and real steghide's own libjpeg-based writer) but it's been found and fixed, checked against a real compiled steghide 0.6.0 in this repo's differential harness (`npm run test:differential:steghide`, which needs a local build of steghide; the full run on 2026-10-20 passed 2,372 of 2,372 checks, using synthetic cover files, and a separate script, run on 2026-10-22 against six camera JPEGs, is not part of that count). If extraction still fails, it's a wrong passphrase, a non-default cipher, or the file wasn't made with steghide at all.
What does the CTF auto-try actually do?
It tries the empty passphrase first, then 58 built-in common words and tool names (steghide, password, flag, ctf, 123456 …) against the real extraction pipeline, stopping at the first one whose magic bytes match. The list is short and hand-written, not taken from a measured password corpus. It runs in your browser tab; the file and passphrases are not sent anywhere.
The checksum says 'Mismatch' — is my data corrupted?
The payload was still fully extracted, but its CRC32 doesn't match what was embedded — usually because the file was re-compressed, re-saved, or transcoded by another program after embedding (which changes the carrier's DCT coefficients or PCM samples), corrupting the embedded data. The bytes shown may be partially wrong.
Can this extract a file made with real steghide's RC4/ARCFOUR, WAKE, or PANAMA option?
This port decodes the default cipher (Rijndael-128/CBC = AES-256-CBC) plus DES, Triple-DES, Blowfish, RC2, CAST-128, Twofish, Serpent, XTEA, SAFER SK-64, SAFER SK-128, SAFER+, CAST-256, 3-WAY, GOST, Rijndael-192, Rijndael-256, LOKI97, Enigma, ARCFOUR, WAKE, and PANAMA (`-e des`/`-e tripledes`/`-e blowfish`/`-e rc2`/`-e cast-128`/`-e twofish`/`-e serpent`/`-e xtea`/`-e safer-sk64`/`-e safer-sk128`/`-e safer+`/`-e cast-256`/`-e 3-way`/`-e gost`/`-e rijndael-192`/`-e rijndael-256`/`-e loki97`/`-e enigma`/`-e arcfour`/`-e wake`/`-e panama`) — detected automatically from the file, no need to specify which one. Every real steghide `-e` algorithm is supported; a file made with an unknown/corrupted algorithm id reports a clear "unsupported encryption algorithm" error rather than silently returning garbage.
Is there an online version of steghide extract -sf?
This page does what `steghide extract -sf file.jpg -p passphrase` does for JPEG, WAV, AU and BMP files: upload the stego file, type the passphrase (leave it blank for none) and extract. It reads the same position order, decrypts with the cipher recorded in the file and checks the CRC32 if one was stored. Nothing is installed and the file is not sent to a server. It extracts only; it does not list the file's capacity the way `steghide info` does.
This isn't steghide data — what else can I try?
If the file isn't steghide-encoded, try this site's general JPEG Steganography tool (F5/JSteg/metadata methods) or Audio/WAV Steganography tool for other embedding methods, the Steganography Analyzer for a broader statistical scan, or the Steganography Detector for method fingerprinting.
Is this the same as Stegseek or Stegcracker — can it brute-force a password?
No. Forensic mode's auto-try checks the empty passphrase plus 58 common words against the real extraction pipeline, entirely in your browser. It only helps when the passphrase is one of those words. Stegseek and Stegcracker are separate programs made for wordlist attacks on steghide files; this tool does not attempt that, and we have not compared speeds. If the 58-word auto-try doesn't find it and you don't know the passphrase, a dedicated brute-force tool against a real wordlist is the next step.
Related Tools
Steghide Online
Hide text or files inside a JPEG, WAV, AU, or BMP using a client-side reimplementation of the steghide algorithm — graph-theoretic minimum-distortion matching, AES-256-CBC encryption, and the same passphrase-seeded position selection real steghide uses. In our tests on synthetic covers, files it makes extract correctly with steghide 0.6.0, and vice versa (every cipher on JPEG, a subset on WAV, AU and BMP). Processed in your browser, not uploaded.
Steganography Detector
Statistical steganalysis with three published tests — chi-square, RS analysis and Sample Pairs — fused into one score and checked against the real StegExpose on a small test set. Payload size estimate. Method fingerprint. WAV audio support. Processed in your browser, not uploaded.