PNG Steganography Workspace

Choose a PNG or WebP cover, add your message, and download a lossless PNG.

Browser only

Drop a PNG or WebP here, or

Up to 8 MB and 8 megapixels. Output is always a lossless PNG.

Capacity usage 0 / 0 bytes
No passphrase

Passphrase enables authenticated AES-256 encryption with PBKDF2-SHA-256. Leave blank for plain text with a corruption check.

Drop a PNG here or

Images created on this tool work best. JPEGs are not supported.

Heads up: If the passphrase is wrong or the image lacks hidden data you will see an error message instead of text.

Advanced options

Reduces payload size for large text. We automatically decompress after extraction.

Passphrase encryption requires HTTPS or localhost. AES-GCM is preferred; authenticated AES-CBC/HMAC is used only when Web Crypto is unavailable but secure randomness remains available.

Tips

  • Compressing binary data (e.g., Base64) may not shrink the payload. Keep an eye on the capacity meter.
  • Version 2 authenticates flags, KDF settings, salt, IV, ciphertext, and length metadata.
  • The hide/extract forms remember these options while the page stays open.

How it works

  • Optional encryption

    Set a passphrase to encrypt your message with AES-256 before embedding.

  • Lossless output

    PNG and WebP covers are converted to a lossless PNG so the embedded bits survive ordinary file sharing.

  • Smart capacity

    Live capacity tracking helps you stay within safe limits for natural-looking images.

Responsible use

Steganography is provided for educational and privacy-friendly purposes. Do not use it to conceal harmful or illegal content.

Need to decode regular text? Return to the main encoder & decoder.

Steganography FAQ

Encryption is enabled only on HTTPS or localhost. We prefer AES-256-GCM and use a CBC/HMAC compatibility mode only when Web Crypto is unavailable. PBKDF2-SHA-256 uses 600,000 iterations, and every version 2 metadata field is authenticated before plaintext is shown.

Text with lots of repetition compresses well and increases the amount you can hide. Already-encoded data such as Base64 or random-looking output will not shrink much. The capacity meter updates as you toggle compression.

No. Everything runs in your browser and the stego image is generated locally. Download the result if you want to share it—no data is uploaded to our servers.