WAV Steganography Extractor
Extract hidden text or files from WAV audio. WAVSTEG auto-detect, RIFF chunk inspector, DeepSound signature detection, spectrogram analysis, 12-config ranked brute-force, CTF flag detector. 100% client-side.
Before uploading: share the output only as a file attachment (email, cloud storage, Discord file). YouTube, SoundCloud, Spotify, and WhatsApp all re-encode audio and destroy hidden data.
Try demo — extract hidden message instantly
Loads a short sample WAV — no upload needed
Drop a WAV file here
PCM integer or IEEE float — MP3/ADPCM not supported
100% Client-Side Processing
Your audio is processed entirely in this browser tab. Nothing is uploaded.
How to Extract Hidden Data from a WAV File (5 steps)
- Upload the WAV file to check
- Click Extract — a WAVSTEG header decodes instantly if present
- For CTF files with no header: check the Samples/Chunks/Spectrogram/DeepSound tabs or run brute-force
- Enter a passphrase if the payload was AES-256 encrypted
- Copy the text or download the hidden file
WAV Steganography Decoding — What This Tool Handles
| Method | Technique | When to Use | Best For |
|---|---|---|---|
| WAVSTEG auto-detect | Reads the 20-byte header from the first 160 sample LSBs | Companion-encoded files | Instant, zero-config extraction |
| LSB chi-square | Tests sample-LSB distribution for bias | No header present | Flags sequential LSB/PRNG embedding |
| DeepSound detection | Scans the LIST chunk for the DeepSound 2.x signature | CTF challenges using DeepSound | Cross-platform decode without Windows |
| Ranked brute-force | Tries 12 common WAV steganography configurations | No header present | CTF challenges, unknown encoders |
Frequently Asked Questions
Can this decode DeepSound-encoded WAV files?
This tool detects the DeepSound 2.x signature (a LIST chunk containing INFOSOFTWARE=DeepSound) and decodes via the same LSB path as WAVSTEG. It is not a byte-exact reimplementation of DeepSound's proprietary format — for files DeepSound itself created outside this tool's own compatibility mode, decode success isn't guaranteed.
Why can't PRNG mode be brute-forced?
PRNG mode uses the passphrase as a seed to select a pseudo-random sequence of sample positions. Without the exact passphrase, that sequence cannot be reconstructed — extraction is mathematically impossible. If you know a file used PRNG mode, you need the passphrase.
What does the Spectrogram tab detect?
It runs a real FFT over the audio and looks for structured, high-variance energy in the 4-8 kHz band — the classic CTF 'look at the spectrogram' range. This is a statistical signal, not proof: musical or broadband audio can occasionally show similar patterns naturally.
My brute-force found garbage — why?
The payload was likely AES-256-GCM encrypted. Enter the passphrase and try again. If using PRNG mode, the passphrase also seeds the sample selection order — without it, extraction fails regardless of decryption.
Is my audio uploaded anywhere?
Never. All decoding runs entirely in your browser using a WebWorker and the Web Crypto API.
Related Tools
WAV Steganography Hider
Hide text or files inside WAV audio using LSB in PCM samples, PRNG sample selection, RIFF chunk injection, or spectrogram encoding. DeepSound-compatible, WavSteg-compatible, AES-256-GCM. 100% client-side.
Audio Steganography Extractor
Extract hidden text or files from WAV or MP3 audio. Auto-detect all algorithms, AES-256 decryption, CTF flag highlighting. 100% client-side.
Steganography Detector
Statistical steganalysis using four algorithms — chi-square, RS analysis, sample pairs, primary sets. StegExpose-equivalent. Payload size estimate. Method fingerprint. WAV audio support. No upload.