Hide Text in an Image

How to hide a message in an image

1. Drop an image on the drop zone, or click it to choose one. PNG is best, but any image your browser can open works: the result is always saved as a new PNG.
2. Under Hide a message, type your text in Secret message. The Capacity line shows how many bytes the message uses and how many the image can hold.
3. For confidentiality, tick Encrypt the message with a passphrase (AES-256-GCM) and type a Passphrase. Show passphrase lets you check what you typed.
4. Click Hide message and download PNG. The file is saved as name-hidden.png, and the status line tells you how many colour values were changed.

How to reveal a hidden message

1. Drop the PNG in the same drop zone. If it contains a message hidden by this tool, a note says so as soon as the image is loaded.
2. If the message was encrypted, type it in Passphrase (only if the message was encrypted).
3. Click Reveal hidden message. The text appears under Hidden message, ready to copy.

Everything happens in your browser: the image, the message and the passphrase are never uploaded.

How it works: least significant bit (LSB)

Each pixel stores a red, a green and a blue value between 0 and 255. This tool replaces the last bit (the least significant bit) of these three values with one bit of your message, pixel after pixel in reading order. For example, a red value of 200 is 11001000 in binary; storing the bit 1 gives 11001001, which is 201. A colour value never changes by more than 1, a difference the eye cannot see.

Only fully opaque pixels are used, and the alpha channel is never touched. Semi-transparent pixels are skipped, because browsers cannot keep their low bits exactly. Before the message, the tool writes a 13-byte header: a signature, a flag saying whether the message is encrypted, the length and a CRC-32 checksum that detects damaged data.

Capacity is about (number of opaque pixels × 3 ÷ 8) − 13 bytes. A 1000 × 1000 photo holds about 375,000 bytes, far more than any text message. Encryption adds 49 bytes (version, iteration count, 16-byte salt, 12-byte IV and 16-byte authentication tag). With encryption, the key is derived from your passphrase with PBKDF2-SHA-256 (600,000 iterations) and the text is encrypted with AES-256-GCM, which also detects any tampering.

What steganography does not do

Steganography hides that a message exists; it is not strong security on its own. Sequential LSB embedding like this is easy to detect with steganalysis tools (chi-square tests, LSB plane analysis), and anyone who opens the image in this tool can read an unencrypted message. If the content must stay private, use the encryption option with a long, unique passphrase: the protection is only as strong as the passphrase. Even then, encryption protects the content, not the fact that something is hidden.

The hidden bits are also fragile. JPEG or WebP recompression, resizing, cropping, screenshots, filters and most social networks and messaging apps (which recompress and often convert images) destroy the message. Share the PNG as a file: an email attachment, a cloud storage link, or “send as document” in a messaging app.

Responsible use

Good uses include puzzles, escape games and CTF challenges, marking your own images, teaching how digital images work, and keeping private notes. Do not use it to get around workplace or school policies or the law, and respect other people’s images and copyright.