StegSolve Online
Full StegSolve.jar in your browser. 28 bit planes, auto-scan, chi-square LSB detection, brute-force extractor, PNG chunk analysis, stereogram solver. No Java, no install.
Encoded a message with our LSB Hider? Here's how to verify it in StegSolve.
How to Analyse a Steganographic Image (5 steps)
- Upload your image (PNG, BMP, JPEG, GIF, WebP, AVIF, or HEIC) — files never leave your browser
- Quick Scan runs automatically: chi-square LSB test, QR detection, PNG chunk parsing
- Open the Analysis Workspace and browse 28 bit planes across R/G/B/A channels
- Use the Extract tab to pull raw bits using any combination of channels and byte order
- Switch to Forensics mode and run Brute-Force to test all 255 channel combos automatically
Once you've identified the plane, extract the hidden data here. Prefer automated detection? Try our Zsteg tool to scan all planes and filters at once.
Extracted data isn't always plain text — it can be a compressed archive, an image, or another file entirely. If the hidden content turns out to be a file rather than text, use the File Hider to hide or extract it.
If you see nothing in the bit planes
Not every hidden file is pixel-level LSB steganography. Polyglot files hide data at the format level — appended after the image's real EOF marker or tucked inside an unused chunk — which never touches a bit plane. If every plane looks like clean noise, check with the PNG/MP3 Polyglot Analyzer instead.
StegSolve Online — Analysis Methods
| Method | Technique | Format | Best For |
|---|---|---|---|
| Bit Plane Viewer | R/G/B/A channels × 8 bits = 28 planes | PNG, BMP | Essential — start here |
| Auto-Scan | Chi-square + QR + PNG tEXt/zTXt parsing | PNG primarily | Fastest flag finder |
| Data Extraction | Any bit-combo · Row/Col · MSB/LSB order | All lossless | StegSolve-compatible |
| Image Combiner | XOR / AND / OR / ADD / SUB between two images | All formats | Two-image CTF challenges |
| Brute-Force | 255 combos ranked by readability score | All lossless | Forensics mode — last resort |
| Stereogram Solver | Horizontal offset reveal for SIRDS images | PNG, BMP | Stereogram CTF challenges |
Frequently Asked Questions
What is StegSolve and why is there an online version?
StegSolve is a popular Java-based tool for analysing steganographic images in CTF competitions. The original .jar requires a Java runtime and does not run on Chromebooks, many Linux distros, or modern Macs. StegSolve Online runs fully in your browser — no Java, no install, no file upload.
Is this byte-identical to StegSolve.jar?
Verified directly against StegSolve.jar's original source: the bit-plane viewer, data extractor (row/column order, MSB/LSB packing, all 6 R/G/B interleave orders, Alpha-first channel sequencing), image combiner (all 13 original operations, including exact overflow/wraparound arithmetic for ADD/SUB/MUL — not clamped), Frame Browser navigation, and Stereogram Solver's shift direction now match byte-for-byte, provided "StegSolve ARGB compatibility mode" is enabled in the Extract tab (off by default, since most CTF challenges only need R/G/B and don't need it). PNG, BMP, WebP, and AVIF pixel reading all bypass the browser's Canvas API entirely (dedicated decoders — WebP and AVIF via WASM builds of libwebp/libavif) to avoid a browser-only rounding quirk that doesn't exist in the original desktop tool. One caveat: AVIF's own codec has a small inherent rounding limit even without that browser quirk, so — like JPEG — it isn't reliable for exact LSB payloads regardless of decoder; the other three formats are unaffected by this. TIFF can't be decoded by any browser at all, not just this one. Full breakdown in OUTPUT_DIVERGENCES.md. This version also adds 34 enhancements on top: auto-scan, chi-square detection, QR code recognition, PNG tEXt/zTXt chunk parsing, EXIF viewer, stereogram solver, brute-force combinator, and a session log.
Does my image get uploaded to a server?
No. All processing happens in your browser using the Canvas API. Your file never leaves your device.
Which file formats are supported?
PNG, BMP, JPEG, GIF (animated — all frames extracted), WebP, AVIF, HEIC/HEIF, and ICO. TIFF and PSD are not supported — no mainstream browser can decode either at all, so this is a platform limitation rather than something this tool can fix. For CTF challenges use PNG, BMP, or WebP — these three read directly from the file bytes rather than through the browser's image compositing pipeline, so results are byte-exact even for partially-transparent images. AVIF also reads directly from the file bytes now, but its own codec has a small inherent rounding limit (like JPEG) that makes exact LSB extraction unreliable regardless. HEIC (the default format for iPhone camera photos) decodes via a dedicated WASM build of libheif — but HEIC is HEVC-based lossy compression, so like JPEG, exact LSB extraction isn't reliable there either regardless of decoder; use it for EXIF/metadata analysis, not bit-plane work. ICO decodes via the browser's own image codec (same as JPEG/GIF), so it carries the same partial-alpha caveat those formats do.
What does the Brute-Force tab do?
Tests all 255 bit-channel combinations (R0, G0, B0, G1+B1 etc.) across 4 byte orders and ranks results by readability score. Results above 90% are almost certainly embedded data. Only available in Forensics mode.
What is the chi-square test?
Chi-square analysis detects LSB steganography by measuring whether adjacent pixel value pairs appear with statistically equal frequency — a hallmark of sequential LSB embedding. A chi-square score above ~0.7 is suspicious.
Related Tools
LSB Extractor
Pull raw bits out of any channel/bit combination once you know which plane holds data.
LSB Embedder (Hider)
The encoder side — hide a text message inside an image's least significant bits.
File Hider
Hide or extract entire files, not just text, inside a carrier image.
Polyglot File Analyzer
Detects data hidden at the file-format level, outside the pixel grid entirely.
Zsteg Online
Runs the same bit-plane and filter checks automatically — no manual browsing.