zsteg Online
zsteg-style LSB channel scanner for PNG and BMP. Scans every bit/channel/order combination and reports results in zsteg's exact output format. No Ruby, no install, no upload.
How to Detect Hidden Data with zsteg Online (5 steps)
- Upload a PNG or BMP image — files never leave your browser
- Pick Quick (zsteg default), Standard (zsteg -a), or Expert (custom parameters)
- The scanner tries every bit/channel/pixel-order combination and streams results as it finds them
- Review results in the beginner-first table, or switch to raw zsteg output for the exact CLI-style lines
- Download the full extracted payload for any result — not just the 256-byte preview
zsteg scans, it doesn't just look
zsteg tries every combination of color channel (R/G/B/A), bit position, and pixel order, then reports anything that looks like text, a file, or metadata. It's the standard first move for any PNG/BMP CTF challenge — this tool runs the same scan entirely in your browser.
zsteg Online — Detection Methods
| Method | Technique | Format | Best For |
|---|---|---|---|
| imagedata check | Raw pixel bytes read as text, before any channel extraction | PNG, BMP | Always runs first — matches real zsteg |
| Channel/bit scan | r, g, b, rgb, bgr, a, rgba, abgr × bits 1-8 × 7 pixel orders | PNG, BMP | The core zsteg technique |
| File signature detect | 16 magic-byte patterns (ZIP, PNG, PDF, ELF, PE32, OpenPGP...) | Any extracted bytes | Confirms hidden files |
| zlib detection | Magic bytes + real decompression via the browser's native DecompressionStream | Compressed payloads | Common CTF technique |
| Metadata scan | PNG tEXt/zTXt/iTXt chunks | PNG only | Catches metadata-hidden flags |
| wbStego format | Structural header match (size, even, encryption type) | Any extracted bytes | Legacy stego tool compatibility |
| Weighted/custom bits | r3g2b3 syntax, custom bit patterns (0x88, 00001110, 1,3,5) | Extraction tab | Full zsteg -b parameter surface |
| Prime/invert/shift/step | Sieve of Eratosthenes pixel filter, XOR invert, bit shift/stride | Extraction tab | Matches zsteg's --prime/--invert/--shift/--step flags |
Frequently Asked Questions
What is zsteg and why is there an online version?
zsteg is a Ruby command-line tool that scans PNG and BMP images for LSB (least significant bit) steganography across many channel and bit combinations. It requires installing Ruby and the zsteg gem, and only runs natively on Linux/Mac. This tool reimplements zsteg's scanning logic entirely in the browser — no Ruby, no install, no upload.
Is this byte-identical to the real zsteg CLI?
The bit-assembly algorithm, pixel-order traversal, and output format (parameter string padding, ".." separator, text/file/zlib/meta labels) are verified against zsteg's source line-for-line. PNG and BMP pixels are decoded directly from the file bytes — not through the browser's Canvas API — so there's no gamma-correction or alpha-premultiplication drift, which was the main source of imprecision browser-based reimplementations usually hit. 16-bit PNGs read the true low byte of each 16-bit sample rather than a rescaled approximation. Adam7-interlaced PNGs are fully deinterlaced before scanning, and indexed/RLE-compressed BMPs decode correctly too (they carry no alpha channel, so there's no premultiplication risk to work around). The Extraction tab exposes zsteg's full parameter surface — weighted channels (r3g2b3), custom bit patterns (0x88 / 00001110 / 1,3,5), prime-pixel filtering, invert, shift, and step.
Does my image get uploaded to a server?
No. All scanning happens in your browser using a WebWorker. Your file never leaves your device.
Why only PNG and BMP?
That's what the real zsteg targets too — JPEG's lossy compression destroys LSB data before it ever reaches a decoder, so scanning a JPEG for LSB steganography is meaningless. Use a JPEG-specific tool (steghide, outguess) for lossy formats instead.
What's the difference between Quick, Standard, and Expert mode?
Quick mirrors running zsteg with no flags: bits 1-4, 8 priority channels, row-major order only. Standard and Expert both mirror zsteg -a: bits 1-8, all 7 pixel orders. Whichever mode you're in, the Extraction tab lets you build and run any single bits/channel/bit-order/pixel-order combination on demand against the real image — including ones outside whatever the last full scan covered.
Can I extract the full payload, not just a preview?
Yes. The real zsteg CLI caps output at 256 bytes unless you pass --limit 0. This tool has no cap for downloads — clicking "Extract Full" on any result always pulls the complete payload before offering it for download.