StegoToolkit

WAV Steganography Extractor

Extract hidden text or files from WAV audio. WAVSTEG auto-detect, RIFF chunk inspector, DeepSound signature detection, spectrogram analysis, 12-config ranked brute-force, CTF flag detector. 100% client-side.

WAVSTEG auto-detect
DeepSound + Spectrogram analysis
Flag detector
100% client-side

Before uploading: share the output only as a file attachment (email, cloud storage, Discord file). YouTube, SoundCloud, Spotify, and WhatsApp all re-encode audio and destroy hidden data.

Try demo — extract hidden message instantly

Loads a short sample WAV — no upload needed

Drop a WAV file here

PCM integer or IEEE float — MP3/ADPCM not supported

100% Client-Side Processing

Your audio is processed entirely in this browser tab. Nothing is uploaded.

How to Extract Hidden Data from a WAV File (5 steps)

  1. Upload the WAV file to check
  2. Click Extract — a WAVSTEG header decodes instantly if present
  3. For CTF files with no header: check the Samples/Chunks/Spectrogram/DeepSound tabs or run brute-force
  4. Enter a passphrase if the payload was AES-256 encrypted
  5. Copy the text or download the hidden file

WAV Steganography Decoding — What This Tool Handles

MethodTechniqueWhen to UseBest For
WAVSTEG auto-detectReads the 20-byte header from the first 160 sample LSBsCompanion-encoded filesInstant, zero-config extraction
LSB chi-squareTests sample-LSB distribution for biasNo header presentFlags sequential LSB/PRNG embedding
DeepSound detectionScans the LIST chunk for the DeepSound 2.x signatureCTF challenges using DeepSoundCross-platform decode without Windows
Ranked brute-forceTries 12 common WAV steganography configurationsNo header presentCTF challenges, unknown encoders

Frequently Asked Questions

Can this decode DeepSound-encoded WAV files?

This tool detects the DeepSound 2.x signature (a LIST chunk containing INFOSOFTWARE=DeepSound) and decodes via the same LSB path as WAVSTEG. It is not a byte-exact reimplementation of DeepSound's proprietary format — for files DeepSound itself created outside this tool's own compatibility mode, decode success isn't guaranteed.

Why can't PRNG mode be brute-forced?

PRNG mode uses the passphrase as a seed to select a pseudo-random sequence of sample positions. Without the exact passphrase, that sequence cannot be reconstructed — extraction is mathematically impossible. If you know a file used PRNG mode, you need the passphrase.

What does the Spectrogram tab detect?

It runs a real FFT over the audio and looks for structured, high-variance energy in the 4-8 kHz band — the classic CTF 'look at the spectrogram' range. This is a statistical signal, not proof: musical or broadband audio can occasionally show similar patterns naturally.

My brute-force found garbage — why?

The payload was likely AES-256-GCM encrypted. Enter the passphrase and try again. If using PRNG mode, the passphrase also seeds the sample selection order — without it, extraction fails regardless of decryption.

Is my audio uploaded anywhere?

Never. All decoding runs entirely in your browser using a WebWorker and the Web Crypto API.

Related Tools