Text Steganography Extractor
Auto-detect and extract messages hidden with this site's Text Steganography Hider using homoglyph, whitespace, and spacing methods. Anomaly hints and attribution of this tool's batch watermarks. Processed in your browser, not uploaded.
Processed in your browser. Your text is not sent to a server. Detects trailing whitespace, inter-word spacing, Unicode space substitution, and homoglyphs.
How to Extract a Hidden Message from Text (5 steps)
- Paste the suspicious text — anomaly detection updates as you type
- Review the Anomaly Score and anomaly breakdown to see which method is most likely
- Select the method to try (or use Auto-Detect to try all four automatically)
- Enter the password if the payload was encrypted, then click Extract
- Download the extracted payload or use Watermark Attribution to identify the recipient
Extraction Methods — What This Tool Detects
| Method | Technique | Processing | Best For |
|---|---|---|---|
| Auto-Detect | Tries all 4 methods in priority order: Homoglyph → Trailing WS → Unicode WS → Inter-Word | Runs in your browser; processing time depends on text length and device | Best starting point — use when method is unknown |
| Unicode Homoglyph | Scans for Cyrillic/special characters in Latin text. Each glyph position encodes one bit | Browser-based scan | Text watermarks, leak-detection experiments, CTF challenges |
| Trailing Whitespace | Reads trailing space/tab per line, using this tool's own bit encoding | Browser-based scan | CTF challenges, plain text files |
| Unicode Whitespace | Reads thin/hair/en/em space variants (U+2009/200A/2002/2003) for 2-bit encoding | Browser-based scan | High-capacity texts where Unicode spaces are preserved |
| Inter-Word Spacing | Counts single vs double spaces between words | Browser-based scan | Plain text files and basic watermarks |
What the Text Extractor Does
You paste a text and the Extractor reads the hidden bits written by this site's Text Steganography Hider. It counts the features the four methods use (look-alike letters, Unicode spaces, trailing whitespace on lines, double spaces) and shows an Anomaly Score, then tries the method you pick or all four in order: Homoglyph, Trailing Whitespace, Unicode Whitespace, Inter-Word Spacing.
It reads this tool's own bit layout (a 4-byte big-endian length, then the message, most-significant bit first). It does not read other programs' formats: Trailing Whitespace here is not the stegsnow layout, and it will not decode text hidden by another tool.
How It Decides
For each method it reads the bits in text order, interprets the first 4 bytes as a big-endian length, and checks whether that length fits the available text positions. A fitting frame is only a candidate payload, not proof that the intended message was found. A method whose frame fits is reported as found, and its bytes are labelled: plain text, a file with a recognised signature, encrypted-looking data (the layout of this site's AES-256-GCM format or very high entropy), binary data or noise. When no method has a fitting frame the result is no payload. With several candidates, flags and decrypted or plain text are preferred. A Reed-Solomon payload is recognised from its own header and repaired where possible.
A valid length is not proof that you found the right message, and an unencrypted message has no checksum: a text that was altered after hiding can return wrong bytes. If a password was used and AES-GCM authentication succeeds, the encrypted payload is intact and the password is right; a failure can mean a wrong password or altered data.
The Anomaly Score
The score is the sum of four capped parts: the share of lines with trailing whitespace (one point per 4 percent of lines, up to 25), double spaces (up to 20, one point per three), Unicode space characters (up to 25, one point each) and look-alike letters (up to 30, two points each). It is Low below 25, Medium from 25, High from 50 and Very High from 75.
It counts features, not messages, so ordinary text can score high: Russian text has genuine Cyrillic letters, and a text with two spaces after each full stop has double spaces. A low score does not show that nothing is hidden either, because a short message changes only a few characters.
What Each Method Reads
| Method | Position | 0 bit | 1 bit |
|---|---|---|---|
| Homoglyph | Each letter among a e o p c x y C L I | the Latin letter | its look-alike (Cyrillic or Roman numeral) |
| Trailing Whitespace | End of each line | one space | one tab |
| Unicode Whitespace | Each space (2 bits) | 00 U+2009, 01 U+200A | 10 U+2002, 11 U+2003 |
| Inter-Word Spacing | Each gap between words | single space | double space |
Examples
Input: A 221-character paragraph produced by the Hider with Homoglyph and the message Hi
Result: Anomaly Score from the 7 look-alike letters; Auto-Detect reports Homoglyph, Plaintext, Hi.
Meaning: The 7 substituted letters are 1 bits. The method is found because its length frame fits and the bytes read as text.
Input: A 60-line text with trailing spaces and tabs written by the Hider (message OK)
Result: Trailing WS: 48 lines; Auto-Detect reports Trailing Whitespace, Plaintext, OK.
Meaning: A space is 0 and a tab is 1 at the end of each line, read from the first line down.
Input: An encrypted message read with the right password, a wrong password and none
Result: Right: the message and 'Decrypted'. Wrong: 'Wrong password: … AES-GCM authentication failed'. None: 'Looks encrypted'.
Meaning: A wrong password cannot be told from damaged data; both fail authentication.
How the Text Extractor Works
Analyse the text
The Anomaly Score and the counts of trailing-whitespace lines, double spaces, Unicode spaces and look-alike letters are calculated as you type.
Extract the bits
For the chosen method (or each of the four in order) the bits are read in text order.
Read the frame
The first 4 bytes give the length. A length that does not fit in the text means that method found nothing.
Decrypt and repair
A Reed-Solomon header is detected from the payload itself and repaired where possible; with a password the AES-GCM tag is checked.
Interpret
The result is typed as plaintext, a file (by signature), encrypted-looking data, binary data or no payload, and flags in the text are highlighted.
What the results mean
| Result | What it means | What to do |
|---|---|---|
| Extracted via … — Plaintext ✓ | The bytes read as text. | Read the message; a valid length alone does not prove it is the intended one. |
| File (binary) | A recognised file signature was found. The Hider stores no file name, so the download is named extracted-payload with the matching extension. | Download it and open it with the matching program. |
| Looks encrypted 🔐 | The data has the layout of this site's AES-256-GCM format or very high entropy; compressed data looks the same. | Go back and enter the password. |
| Wrong password | The data has the encrypted layout but AES-GCM authentication failed. A wrong password and damaged data give the same failure. | Check the password (case sensitive) and that the text was not changed. |
| Reed-Solomon repaired N byte(s) | The decoder corrected N changed bytes using the Reed-Solomon parity. Correction alone does not prove the intended message was recovered; with this tool's AES-GCM format, successful authentication also checks the ciphertext. | Review the message; for an unencrypted payload nothing authenticates it. |
| Reed-Solomon could not repair N block(s) | Too many bytes in a block changed; the bytes are shown as found. | Treat them as possibly wrong; without a password nothing can confirm them. |
| No payload | No method produced a valid frame. | Try the other methods manually, check that the text kept its spaces, tabs and letters, or the message may be from another tool. |
Limitations
- Only this site's Text Steganography Hider layout is read; other tools' formats are not.
- An unencrypted message has no checksum, so an altered text can return wrong bytes without a warning.
- A text that passed through a service which rewrites spaces, letters or line ends may lose the message; no service was tested.
- The Anomaly Score counts features and can be high for ordinary text and low for a short message.
- The Document Cleaner changes genuine Cyrillic letters too and does not remove zero-width characters, so it is not a safe-to-redistribute guarantee.
Privacy
The text is processed in your browser tab and is not uploaded. Usage statistics may record which options were used, such as the method, never the text, the message or the password. The hosting provider keeps ordinary request logs for page loads.
Which Tool Next?
- Text Steganography Hider — hide a message with these four methods.
- Invisible Text Extractor — read zero-width characters.
- Whitespace Steganography Extractor — a separate tool with its own header and SNOW-style mode.
- Steganography Analyzer — statistical checks for images and other files.
Frequently Asked Questions
What does the Anomaly Score mean?
It is a 0–100 heuristic, not a probability. Components: share of lines with trailing whitespace (1 point per 4 percent of lines, up to 25), number of double spaces (1 point per 3, up to 20), number of thin/hair/en/em spaces (1 point each, up to 25) and number of look-alike letters from this tool's list (2 points each, up to 30). A high score means "worth decoding"; ordinary text with Cyrillic words, double spaces or trailing spaces can score high, and a clean-looking text can hide data. The score updates as you paste text.
Can I decode files encoded by other trailing-whitespace tools like stegsnow?
Not reliably — this decoder reads its own bit encoding and payload framing, not stegsnow's wire format, so files produced by the stegsnow CLI generally won't decode correctly here. It reliably decodes text produced by this site's own Trailing Whitespace encoder, including AES-256-GCM encrypted payloads.
What is Watermark Attribution?
If the text was encoded using batch watermarking (each recipient got a unique copy), the decoded payload contains `WM:{id}:{recipient}`. Paste the contents of the watermark-key.json file from the Hider's ZIP and the decoder looks the ID up and shows the recipient. It only identifies copies made by this tool's batch mode.
What does 'Encrypted' kind mean in the results?
The decoded bytes have the structure of this site's AES-256-GCM format (or very high entropy), so they are probably encrypted. Compressed or random data looks the same. Enter the password: if the data has this site's encrypted layout and the password is wrong, the result says so (AES-GCM authentication failed). Without a password the two cases look the same.
Is the pasted text changed before it is read?
No. The text is read exactly as pasted (including trailing spaces and tabs on the last line), except that your browser's text box turns Windows line endings into plain line feeds. Reed-Solomon needs no setting: the Extractor recognises the parity header the Hider wrote.
Can I detect homoglyphs without decoding?
Partly. After you run the Extractor, the Homoglyph Visualizer shows every look-alike letter from this tool's list (Cyrillic а е о р с х у, Roman-numeral Ⅽ Ⅼ Ⅰ) in red with its Unicode code point on hover, and the live Anomaly Score counts them while you paste. It does not know other look-alike pairs, and genuine Cyrillic text is flagged too.
Does the Document Cleaner remove all hidden data?
The Document Cleaner replaces this tool's look-alike characters with Latin letters, strips trailing whitespace and turns Unicode spaces and repeated spaces into single spaces. It only knows this tool's methods: it does not remove zero-width characters or data hidden by other tools, and it will also change genuine Cyrillic letters such as а е о р с х у in a Russian text. Check the result before you rely on it.
Related Tools
Text Steganography Hider
Hide secret messages or watermarks in plain text using Unicode homoglyphs, trailing whitespace, Unicode spaces, or inter-word spacing. Optional AES-256-GCM encryption and Reed-Solomon parity. Processed in your browser, not uploaded.
Steganography Detector
Statistical steganalysis with three published tests — chi-square, RS analysis and Sample Pairs — fused into one score and checked against the real StegExpose on a small test set. Payload size estimate. Method fingerprint. WAV audio support. Processed in your browser, not uploaded.
Invisible Text Hider
Hide secret messages inside visible text using zero-width Unicode characters. Add optional AES-256-GCM encryption and check payload capacity before encoding. Processing happens in your browser; the text and payload are not uploaded to StegoToolkit's server.
Invisible Text Extractor
Detect and extract hidden messages from text containing zero-width Unicode characters. Tries six character-set combinations, decrypts AES-256-GCM payloads when you give the password and highlights CTF flags. Processed in your browser; the text is not uploaded to StegoToolkit's server.