I Built an Image Steganography Tool — Hide Any File Inside a PNG with AES-256 Encryption

Rishu — Wed, 01 Jul 2026 08:06:52 +0000

I've been fascinated by steganography for a while — the idea that you can hide a file inside an image, and nobody would ever know it's there. Not just encrypted, but completely invisible.

So I built Stego.Image. A free, open-source tool that does exactly that — hide any file inside a PNG image, entirely in your browser.

What is steganography?

Steganography is hiding data inside another file so that the existence of the hidden data is concealed. It's different from encryption — encryption makes data unreadable, steganography makes data invisible.

The most common digital technique is LSB steganography — hiding bits of data in the least significant bits of image pixels. Changing the last bit of a pixel's color value shifts it by just 1 out of 255. Completely imperceptible to the human eye.

Original:  11001010  →  202
Modified:  11001011  →  203  ← you cannot see this difference

A 1920×1080 image has over 2 million pixels. At 3 bits per pixel across RGB channels, that's enough to hide ~777 KB of data — invisibly.

Why I built this

Most steganography tools I found were either desktop-only, outdated, or required uploading your file to a server. That last part kills the entire point — if your secret file touches someone else's server, it's not secret anymore.

I wanted something that:

runs entirely in the browser
uses proper modern encryption
works on any device, no install

So I built it.

How Stego.Image works

The pipeline has three stages:

1. Compress
The file is compressed using DEFLATE before anything else. Encrypted data is incompressible (it looks like random noise), so compression must happen first. This reduces payload size and increases how much you can hide.

2. Encrypt
Compressed data is encrypted with AES-256. The key is derived using PBKDF2-SHA256 at 100,000 iterations with a randomly generated salt — so your password never becomes the key directly. This makes brute-force attacks computationally expensive.

3. Embed
Encrypted bits are written into the LSBs of each RGB pixel channel using the HTML5 Canvas API. The output is saved as PNG — always PNG, because JPEG's lossy compression would destroy the embedded data on save.

Using it

Hide a file:

Upload a PNG carrier image
Upload the file you want to hide (any format — PDF, ZIP, image, document, anything)
Set a password
Download the output image

The output looks identical to the original. Nobody can tell the difference.

Extract a file:
Upload the stego image → enter the password → download your file.

That's it. No account, no install, no server. Try it at stego.image.

The security problem I fixed mid-build

The first version used crypto-js's default EvpKDF for key derivation — MD5-based, fast, and completely wrong for a security tool. It's the kind of thing that passes a quick test but fails the moment someone runs a brute-force attack.

I replaced it with PBKDF2-SHA256 at 100k iterations with a random salt. Files encoded with the old version are intentionally incompatible with the new one. Security over backward compatibility — no exceptions.

What you can use it for

Sending sensitive documents without revealing what's being transferred
Embedding invisible ownership metadata in images you distribute
Security research — understanding how LSB steganalysis works by building the thing it's trying to detect
Anywhere you need plausible deniability about a file's existence

Stack

React 19, Vite, crypto-js, pako, Bootstrap 5, deployed on Cloudflare Pages.

The entire thing is static — Cloudflare serves the build, your browser does all the work.

🌐 Live: https://stegoimage.pages.dev

🐙 GitHub: https://github.com/50RISHU/Stego.Image

MIT licensed. If you find a bug or want to contribute, PRs are open.

DEV Community: Rishu