LSB Steganography
Hide a message in the least significant bits of an image's pixels. The result looks identical to the original — the change is a value or two per colour channel, far below what an eye can see — and only someone who knows to look here will find it. Optionally encrypt the message first, so finding it is not the same as reading it. Everything runs in your browser.
Any format works as the cover image — the result is always saved as PNG, because JPEG's compression would throw away the exact bits the message lives in.Drop the PNG that was produced by this tool. A re-saved or re-compressed copy will not work.
{{ fileName }} · {{ imageSize.width }}×{{ imageSize.height }}
{{ pixelInfo.skippedPixels.toLocaleString() }} of {{ pixelInfo.totalPixels.toLocaleString() }} pixels are not fully opaque and are skipped automatically — the capacity below already accounts for it.
{{ error }}
Message{{ estimate.payloadBytes }} / {{ estimate.capacityBytes }} bytes
{{ estimate.fits ? `Fits with ${estimate.capacityBytes - estimate.payloadBytes} bytes to spare.` : `Too long by ${estimate.payloadBytes - estimate.capacityBytes} bytes — shorten it, raise the bits per channel, or use a larger image.` }}
Options
1 bit is invisible in practice. Higher values multiply capacity but start to show as banding in smooth gradients and skies, and make the change much easier to detect statistically.
AES-256-GCM with a PBKDF2-stretched key. Without this, anyone who suspects the image carries something can read it with a standard tool — hiding is not the same as protecting.
Result
Download the PNG and share the file itself. Sending it through a chat app's photo mode, or anything that re-compresses images, will destroy the message — send it as a file or document instead. There is no JPEG option here: JPEG's compression is exactly what would erase the hidden bits, so only a lossless re-compression pass runs on the PNG — pixel values, and the message, stay untouched.
What's in this image
Hidden message
{{ revealed }}
About LSB Steganography
Every pixel in an image stores three numbers from 0 to 255 — how much red, green and blue it contains. Changing the last bit of one of those numbers shifts it by exactly one step: a red value of 200 becomes 201. That difference is invisible; monitors do not reliably reproduce it and eyes do not reliably perceive it. But a bit is a bit, and an image with a million pixels has three million of those last bits going spare. That is enough to carry a few hundred kilobytes of text without the picture looking any different.
This page writes a small header first — a signature, whether the payload is encrypted, how many bits per channel it used and how long it is — always at one bit per channel, since that header is what tells the reader how to decode everything after it. The message follows, written only into pixels that are fully opaque. Alpha is never touched, and neither is the colour of any pixel that is not fully opaque — a canvas stores colour premultiplied by alpha, so a partially transparent pixel's low bits do not round-trip reliably, and a PNG optimizer is free to repaint a fully transparent pixel however it likes since nothing renders it anyway. Skipping both is what makes the result exact instead of merely usually-correct. Reading is the same walk in reverse: check the signature, and if it is there, pull the bits back out of the same opaque pixels they were written to.
The output has to be PNG. JPEG achieves its size by discarding detail the eye will not miss — which is precisely, and fatally, the detail a hidden message lives in. Save a stego image as JPEG and the message is gone. The same applies to anything that silently re-encodes an image on your behalf: most social feeds, and the photo-sharing mode of most messaging apps. Send the PNG as a file or document, not as a picture. The download is still run through the same lossless PNG pass Image Optimizer uses, which shrinks the file without changing a single decoded pixel — the one kind of compression that cannot touch the message.
What this does and does not give you. Steganography is concealment, not protection. Plain LSB data is not hard to find for anyone who goes looking — the statistical signature of a modified low-bit plane is well understood, and standard steganalysis tooling detects it routinely, especially above one bit per channel. The password option matters for that reason: encryption means that finding the payload and reading it are two different problems. Treat the hiding as the thing that stops it being noticed, and the encryption as the thing that keeps it secret if it is.
For splitting a secret so that no single image reveals anything at all, Visual Cryptography takes the opposite approach — it looks obviously like an encoded artifact but needs two shares to read. To check what a photo is already carrying without your involvement, the EXIF Inspector reads its embedded metadata.
Privacy: the image, the message and the password stay in this tab. There is no upload, no server call, and no key or payload is written to storage.
