Whitespace Steganography Extractor
Extract hidden data from trailing whitespace, inter-word spacing, line endings, or indentation. WSST auto-detect, SNOW-style raw mode, brute-force.
Enter Stego Text to Decode
Paste the text that may contain hidden whitespace steganography, or upload the original .txt file
Load demo stego text
Pre-encoded sample — extracts automatically
How to Decode Whitespace Steganography (5 steps)
- Paste the suspicious text or upload the .txt file
- Click Auto Extract — WSST format decodes automatically
- For headerless CTF files: use Manual mode with SNOW-style raw format
- Enter passphrase if the payload was encrypted
- Copy the hidden message or download the extracted file
Whitespace Steganography Decoding — What This Tool Handles
| Method | Technique | When to Use | Notes |
|---|---|---|---|
| WSST v1 auto-detect | Reads the 9-byte header embedded via any of the 4 methods | Files from this tool's own Hider | Zero-configuration decode |
| SNOW-style raw | Tab-marked trailing whitespace, no WSST header | CTF challenges using this same technique | This tool's own bit encoding, not the real stegsnow CLI's |
| Headerless brute-force | Tries Inter-Word, Line Ending, and Tab Indentation, scored by printable-byte ratio | Unknown-method files | Priority order matches Tool-42's own ranking |
| AES-256-GCM decrypt | PBKDF2-derived key, applied when the WSST header's enc_flag is set | Encrypted payloads | Wrong password fails cleanly with a clear error |
Frequently Asked Questions
Can this decode files from the real stegsnow CLI?
Not reliably — "Decode as SNOW-style raw format" reads headerless, tab-marked trailing whitespace without expecting the WSST header, which is the same general layout stegsnow uses, but this tool's own bit encoding, not stegsnow's actual variable-length column-radix packing or its ICE cipher. It reliably decodes files produced by this tool's own SNOW-style encoder mode, which never uses encryption.
The text looks normal but extraction finds nothing — why?
Most likely the text was copy-pasted somewhere that stripped whitespace. Trailing spaces, tabs, and double-spaces are removed by email clients, browsers on copy, editors with auto-trim, Git commits, and Slack/Discord. Upload the original .txt file directly instead of pasting.
What does "show whitespace" mode show?
It renders invisible characters visually: · = space, → = tab, ¶ = line ending — exactly like cat -A in Linux. If you see consistent space/tab patterns at line endings, the text likely contains Trailing Space/Tab steganography.
How do I decode an inter-word spacing challenge?
Switch to Standard or Forensic mode and select Inter-Word Spacing manually. The decoder scans word gaps: single space = bit 0, double space = bit 1. Auto-detect also tries this automatically as part of its brute-force pass.