Steghide Online
Hide text or files inside a JPEG, WAV, AU, or BMP using a faithful client-side port of the real steghide algorithm — graph-theoretic minimum-distortion matching, AES-256-CBC encryption, and the same passphrase-seeded position selection real steghide uses. Cross-checked against a real compiled steghide binary. 100% client-side, no upload.
Try the demo instantly
Loads a 400×400 gradient JPEG — no upload needed
Drop your JPEG, WAV, AU, or BMP here or click to browse
.jpg / .jpeg / .wav / .au / .bmp · Max 50 MB
Parsed locally in your browser — nothing uploaded
100% Client-Side — Real Steghide Algorithm
A from-scratch TypeScript port of steghide's own graph-matching embedding for JPEG (DCT coefficients), WAV/AU (PCM/mu-law samples), and BMP (1-bit/4-bit palette indices), verified against official crypto test vectors and cross-checked against a real compiled steghide binary. Your file never leaves this tab.
How to Embed Data in a JPEG, WAV, AU, or BMP with Steghide Online (4 steps)
- Upload a JPEG (.jpg/.jpeg), WAV (.wav), AU (.au/.snd), or BMP (.bmp, 1-bit/4-bit palette only) cover file — the graph-matching algorithm embeds into DCT coefficients (JPEG), PCM/mu-law samples (WAV/AU), or palette indices (BMP).
- Type your secret message or upload a file to hide. Check the capacity estimate — capacity depends on carrier complexity/length, not just file size.
- Enter a passphrase (optional — even a blank one is used for position selection). In Standard/Forensic mode, choose compression, checksum, and encryption.
- Click 'Embed & Download' — embedding runs entirely in your browser via a from-scratch TypeScript port of steghide's own graph-matching algorithm. The output looks/sounds identical to the original.
Steghide Algorithm — Overview
| Method | Technique | Detectability | Best For |
|---|---|---|---|
| Steghide graph-matching (DCT/PCM) | Groups carrier samples into vertices, finds a minimum-distortion matching so most vertices need only a 1-value 2-for-1 swap instead of an independent change | ✅ Lower detectability than plain LSB — no chi-square/RS-analysis signature; resists most statistical steganalysis | CTF challenges expecting real steghide output, covert JPEG/WAV/AU/BMP payloads that must survive casual inspection |
Frequently Asked Questions
Is this actually compatible with the real steghide CLI?
This is a faithful, from-scratch TypeScript port of steghide's own algorithm (key derivation, AES-256-CBC encryption, position-selection PRNG, and the graph-matching embedder), verified against official cryptographic test vectors (MD5, FIPS-197 AES-256, CRC-32) and independent from-scratch oracles for every component — and cross-checked against a real compiled steghide binary. JPEG, WAV, AU, and BMP (1-bit/4-bit) are all verified bidirectionally: files this tool produces decode correctly with real steghide, and files real steghide produces decode correctly here.
Which carrier formats are supported? What about 24-bit BMP?
JPEG (DCT-coefficient), WAV, AU (PCM-sample), and BMP (1-bit/4-bit/8-bit palette) graph-matching are all implemented, sharing the same Selector/passphrase/EmbData wire format underneath. 24-bit (RGB) BMPs use a different embedding scheme (a 3D color-space matching algorithm real steghide's own RGB mode requires) that hasn't been ported yet — a separate, in-progress effort. Uploading one shows a clear error rather than a silent failure.
Which encryption algorithms can I choose when embedding?
Real steghide's default cipher — Rijndael-128/CBC — is literally standard AES-256-CBC (a 128-bit block, 256-bit key Rijndael configuration IS AES-256 by definition). In Forensic mode, the Cipher dropdown also lets you pick DES, Triple-DES, Blowfish, RC2, CAST-128, Twofish, Serpent, XTEA, SAFER SK-64, SAFER SK-128, SAFER+, CAST-256, 3-WAY, GOST, Rijndael-192, Rijndael-256, LOKI97, or Enigma — all 19 are real steghide's own algorithms, and a file made with any of them decodes correctly with the real steghide CLI's own -e flag too. Enigma is a genuinely different stream cipher under the hood (no CBC, no IV), not just another block cipher in the list, though it works the same way from this tool's own UI. Real steghide supports 22 non-default algorithms in total (RC4/ARCFOUR, WAKE, and PANAMA are the remaining ones not yet implemented here).
Does the passphrase always matter, even without encryption?
Yes — unlike most steganography tools' password fields, steghide's passphrase seeds BOTH the embedding-position selection (which samples carry data) AND, if enabled, the AES-256-CBC encryption key. Even an empty passphrase produces a specific, deterministic position order — the extractor needs the exact same passphrase either way.
Why does the file size stay identical after embedding?
Steghide doesn't append or resize anything — it only flips the value of existing carrier samples (by at most 1, via the graph-matching algorithm's minimum-distortion swaps), then re-encodes the same file structure. The output has the same dimensions/duration and (for a typical payload) the same byte count.
Can I password-protect a WAV or AU audio file, not just a JPEG?
Yes — the passphrase and AES-256-CBC encryption work identically across every supported carrier (JPEG, WAV, AU, and BMP 1/4/8-bit). The graph-matching embedder just swaps a different kind of sample per format (DCT coefficients for JPEG, PCM/mu-law samples for WAV/AU, palette indices for BMP) — the passphrase-seeded position selection and encryption layer on top are the same steghide algorithm either way.
Related Tools
Steghide Online Extractor
Extract data hidden by steghide (or by this tool) from a JPEG, WAV, AU, or BMP — same passphrase-seeded position selection, AES-256-CBC decryption, and CRC32 checksum verification as the real steghide CLI. Cross-checked against a real compiled steghide binary. 100% client-side, no upload.
Steganography Capacity Calculator
Calculate exact hidden-payload capacity for PNG, BMP, WebP, WAV, FLAC, AIFF and more — plus PSNR and detection risk, all client-side. Links to the right specialist hider/extractor for your file type.