Hacking Unicode characters to hide secrets in strings

My friends and I built Stegcloak, a pure JavaScript steganography module designed in functional programming style, to hide secrets inside the text by compressing and encrypting with Invisible Characters. It bypasses all blacklists and works everywhere, including the most important ones like Twitter, Gmail, Whatsapp, Telegram, Instagram, Facebook, documents, etc

Interesting? Check out how we built it:

How to Hide Secrets in Strings— Modern Text hiding in JavaScript

Mohan Sundar ・ May 25, 2020 ・ 7 min read

blog.bitsrc.io

Try it out here

Source code

KuroLabs / stegcloak

Hide secrets with invisible characters in plain text securely using passwords 🧙🏻‍♂️⭐

StegCloak

The Cloak of Invisibility for your texts

StegCloak is a pure JavaScript steganography module designed in functional programming style, to hide secrets inside text by compressing and encrypting with Zero Width Characters. It can be used to safely watermark strings, invisible scripts on webpages, texts on social media or for any other covert communication. Completely invisible

Features

• Protect your invisible secret using passwords and HMAC integrity

• Cryptographically secure by encrypting the invisible secret using AES-256-CTR.

• Uses 7 Invisible characters in unicode characters that works everywhere in the web.

  Including the most important ones Tweets, Gmail, Whatsapp, Telegram, Instagram, Facebook etc.

• Maximum Compression to reduce the payload (LZ, Huffman).

• Completely invisible, uses Zero Width Characters instead of white spaces or tabs.

• Super fast! Hides the Wikipedia page-source for steganography (800 lines and 205362 characters) within a covertext of 3 words in under one second.

• Written in pure functional style.

• Usage…

View on GitHub

Comments

[Cyberwrench]

It's brilliant . I stegcloaked and renamed a file in windows with it and it worked even there !! Now I have two file named index :)

[mohanpierce99]

Glad you liked it :)