WebP Steganography Decoder
Extract hidden text or files from WebP images. STW1 auto-detect across 15 configs, scatter mode, heuristic CTF candidate scan, wbpdv trailing-bytes detection, confidence scoring. 100% client-side.
Before uploading: share the output only as a file attachment, not a social/chat "share as image" link — Twitter, Instagram, WhatsApp, and Facebook all re-encode WebP images to JPEG on upload and destroy hidden data.
Try demo — extract hidden message instantly
Loads a short sample lossless WebP — no upload needed
Drop a WebP file here
Lossless (VP8L) works best — lossy (VP8) is auto-converted
100% Client-Side Processing
Your image is decoded and re-encoded entirely in this browser tab via WebAssembly. Nothing is uploaded.
How to Extract Hidden Data from a WebP Image (5 steps)
- Upload the WebP file you want to extract hidden data from
- Enter a password if one was set (leave blank if not)
- Click Extract — Auto-Detect tries the STW1 header across 15 configurations, then falls back to a heuristic scan
- Review the extracted message, file, or CTF flag
- Switch to Forensic mode for manual bit-depth/channel/scatter control and the WebP Format Inspector
Frequently Asked Questions
Can I extract from lossy WebP?
Lossy WebP (VP8) modifies pixel values during compression — hidden LSB data is usually destroyed. This tool attempts extraction anyway (some CTF challenges use lossy WebP deliberately), but results are automatically capped below HIGH confidence — a lossy carrier never returns a HIGH-confidence result.
How do I extract from animated WebP?
Not yet supported — per-frame scanning for animated WebP is a planned feature. Uploading one shows a clear message instead of a silent failure.
The tool found data with LOW confidence — is it real?
LOW confidence means only one weak signal (e.g. a plausible length prefix) matched, not a real structural marker. Look at the actual content — readable text, a valid file signature, or a flag pattern are strong signals; random-looking bytes usually aren't real.
What's Scatter mode, and why doesn't Auto-Detect find it?
Scatter mode shuffles which pixels carry the payload using a passphrase-seeded PRNG. Without the exact passphrase, there's no way to know the pixel order, so scatter-mode files are deliberately excluded from Auto-Detect — use Manual mode (Forensic tier) with the correct password.
The extra-bytes / wbpdv warning appeared — what does that mean?
wbpdv is a different WebP steganography tool that appends data after the file's declared RIFF size, rather than using pixel LSB. This decoder detects the extra trailing bytes and flags it, but doesn't decode wbpdv's own format — try the File Hider Extractor or Polyglot File Analyzer if you suspect this.
Are files uploaded to a server?
No — libwebp-based WebAssembly decode runs entirely in your browser. Files never leave your device.
Related Tools
WebP Steganography Encoder
Hide text or files inside WebP images using LSB embedding across RGB(A) pixels, seeded scatter mode, and automatic lossy-to-lossless conversion. Real pixel-level verification, AES-256-GCM encryption, CTF challenge builder. 100% client-side.
Image Steganography Extractor
Extract hidden messages from steganographic image files. Auto-detect mode, bit plane analysis.
Steganography Detector
Statistical steganalysis using four algorithms — chi-square, RS analysis, sample pairs, primary sets. StegExpose-equivalent. Payload size estimate. Method fingerprint. WAV audio support. No upload.