StegoToolkit

WAV Steganography Hider

Hide text or files inside WAV audio using LSB in PCM samples, PRNG sample selection, RIFF chunk injection, or spectrogram encoding. DeepSound-compatible, WavSteg-compatible, AES-256-GCM. 100% client-side.

4 methods
DeepSound + WavSteg compatible
AES-256
100% client-side

Before uploading: share the output only as a file attachment (email, cloud storage, Discord file). YouTube, SoundCloud, Spotify, and WhatsApp all re-encode audio and destroy hidden data.

Try demo — embed a message instantly

Loads a short sample WAV — no upload needed

Drop a WAV file here

PCM integer or IEEE float — MP3/ADPCM not supported

100% Client-Side Processing

Your audio is processed entirely in this browser tab. Nothing is uploaded.

How to Hide Data in a WAV Audio File (5 steps)

  1. Upload any WAV file — PCM integer or IEEE float, mono or stereo
  2. Type your secret message or upload a file to hide
  3. Choose a method — LSB in samples is inaudible and recommended
  4. Add a passphrase for AES-256-GCM encryption (recommended)
  5. Click Embed — download your stego WAV

WAV Steganography Methods — What This Tool Handles

MethodMechanismCapacityBest For
LSB in PCM SamplesModifies the least significant bits of raw sample values(samples × bit_depth) / 8 bytesRecommended default — inaudible at 1-2 bit depth
PRNG Sample SelectionPassphrase-seeded Mulberry32 picks non-sequential sample positionsSame as LSB, non-sequentialHardest to detect — breaks the sequential pattern LSB detectors expect
RIFF Chunk InjectionPayload lives in a custom RIFF chunk, outside the PCM data entirelyUnlimitedZero audio modification — detectable only by RIFF chunk inspection
Spectrogram EncodingEncodes text as frequency-domain tone bursts appended to the audioGoverned by text lengthClassic CTF 'look at the spectrogram' technique

Frequently Asked Questions

Why is WAV better suited for steganography than MP3?

WAV stores raw PCM samples — exact integer values, no compression. Modifying the least significant bit of a 16-bit sample shifts it by 1 out of 65,536, which is inaudible. MP3's lossy DCT compression destroys precise sample values, so LSB steganography doesn't survive it.

What is DeepSound compatibility?

DeepSound is a popular Windows-only CTF steganography tool. This tool's DeepSound-compatibility mode adds the same LIST-chunk signature DeepSound uses, so DeepSound-aware analysis tools can detect it — it does not reimplement DeepSound's proprietary bit-level format byte-for-byte.

What is WavSteg/stegolsb-compatible mode?

stegolsb (a Python CLI tool) uses plain sequential 16-bit sample LSB with no header, no encryption. This mode matches that exact format — useful for CTF challenges expecting stegolsb-compatible output.

How does Spectrogram Encoding work, and why isn't it encrypted?

Your payload is encoded as tone bursts across 8 frequencies (4-8 kHz) — set bits play their frequency, within a short time slot per byte. Opening the result in Audacity or Sonic Visualizer (Spectrogram view) reveals the pattern visually. Encrypting it would turn the visible pattern into unreadable noise, defeating the entire point — so this method is intentionally never encrypted.

Is my audio uploaded anywhere?

Never. All encoding runs entirely in your browser using a WebWorker and the Web Crypto API. Nothing leaves your device.

Related Tools