Encryption hides what a message says. Steganography hides the fact that there's a message at all.
I'm Muhammad Ali Mughal, and I built PixelValut, a browser-based tool for hiding text inside images. While building it, I learned that most people get two things wrong about steganography. Some think it's magic, and some think it's useless. It's neither. It's a simple technique with real strengths and real limits, and once you see how it works you'll know when to use it.
This guide covers what image steganography is, how to hide a message step by step, where it's actually useful, and the mistakes that quietly destroy hidden data.
What image steganography actually is
Steganography means "covered writing." The digital version tucks data inside an ordinary-looking file, usually an image, so that anyone looking at it sees a normal photo.
The most common method is LSB (least significant bit) embedding. Here's the idea:
- Every pixel in a typical image has three color channels: red, green, and blue.
- Each channel is a number from 0 to 255, stored as 8 bits.
- The last bit of each number (the least significant bit) barely affects the color. Changing a red value from 200 to 201 is invisible to the human eye.
So you take your message, turn it into bits, and write those bits into the last bit of each color channel. The picture looks the same. The data is there for anyone who knows to read it back.
How much can you hide?
With one bit per channel, you get 3 bits per pixel. That adds up quickly:
| Image size | Pixels | Approx. capacity |
|---|---|---|
| 800 × 600 | 480,000 | ~175 KB |
| 1920 × 1080 | ~2.07 million | ~750 KB |
| 4000 × 3000 | 12 million | ~4.3 MB |
Real tools reserve a little space for a header (message length, format markers), and encryption adds some overhead, but for text you'll almost never run out of room. A full page of text is only a few kilobytes.
Why you should encrypt before you hide
LSB embedding on its own is not security. It's obscurity. Anyone who suspects an image contains data can run a standard extraction script and read raw LSB bits. If your message is plain text, it falls right out.
That's why I designed PixelValut to encrypt the message with AES-256 (using the browser's Web Crypto API) before embedding it. Now there are two layers:
- Steganography hides the existence of the message.
- Encryption protects the content if someone finds it anyway.
Without the password, extracted bits look like random noise, which is exactly what LSB data in a natural photo should look like.
How to hide a message in an image, step by step
Whether you use PixelValut or another tool, the workflow is the same.
Step 1: Pick the right cover image
This matters more than people think.
- Use a photo with lots of natural detail: foliage, gravel, clouds, textured walls. Busy images hide changes better than flat ones.
- Avoid big areas of solid color like a plain sky gradient or a logo on white. Statistical tools can spot LSB changes more easily in smooth regions.
- Use an original photo you took, not a famous image from the internet. If someone has the original, comparing the two files reveals that something changed.
Step 2: Write your message and choose a strong password
Keep the message plain text. For the password, use a long passphrase (four or five random words) or a generated password. A random password generator helps here. The encryption is only as strong as the password protecting it.
Step 3: Embed the message
Upload the cover image, paste your message, enter the password, and run the encode step. The tool converts your message to bits, encrypts it, and writes it into the pixel data.
Step 4: Download as PNG, and keep it PNG
This is the step that breaks most hidden messages. Save and share the output as PNG. PNG is lossless, so every bit you wrote stays exactly where you put it.
JPG is lossy. When an image is saved or re-saved as JPG, the compression changes pixel values slightly. That's harmless to the eye and fatal to LSB data.
Step 5: Test the round trip before you send it
Before sharing the image, decode it yourself: upload the PNG, enter the password, and confirm the message comes back intact. It takes 30 seconds and saves a lot of confusion.
Step 6: Share the password through a different channel
If you send the image by email, don't put the password in the same email. Share it in person, over a call, or through a separate messaging app.
Where steganography is actually useful
Steganography isn't just for spy movies. Practical uses I've seen:
- Watermarking and proof of ownership. Photographers and designers embed an invisible signature or ID in their work. If the image gets reposted, you can prove where it came from.
- Tamper detection. If the hidden data no longer decodes correctly, you know the image was edited or re-compressed.
- Private notes in plain sight. Some people store an encrypted note (a recovery phrase hint, a private journal entry) inside an ordinary photo in their gallery.
- Teaching security concepts. It's a great hands-on way to show students how binary, color channels, and encryption work together.
- CTF challenges and puzzles. Capture-the-flag competitions love hidden messages in images.
Limitations you need to know
Being honest about limits is part of using any security tool well.
Social media will destroy your message
Facebook, Instagram, WhatsApp (in normal photo mode), X, and most messaging apps re-compress uploaded images. They resize them, convert them to JPG, and strip metadata. Your hidden data won't survive.
To keep the data intact, send the image as a file or document rather than as a photo, or use cloud storage links and email attachments that keep the original file.
Editing breaks it too
Cropping, resizing, filters, rotation, and screenshots all rewrite pixel values. Treat the output image as read-only.
Detection is possible
Steganalysis tools can detect LSB embedding statistically, especially with large payloads in smooth images. Steganography reduces attention; it doesn't make detection impossible. Keep payloads small relative to image size, and rely on encryption for actual confidentiality.
It's not a replacement for proper secure messaging
If you just need private communication, an end-to-end encrypted messenger is the right tool. Steganography makes sense when you specifically need the message to be invisible, or when you're watermarking, verifying, or learning.
Quick security checklist
Before you hide anything important, run through this:
- [ ] Original, detailed photo (not a downloaded image, not flat colors)
- [ ] Message encrypted with a strong, unique password
- [ ] Output saved as PNG
- [ ] Round-trip decode tested
- [ ] Sent as a file, not through a photo uploader that re-compresses
- [ ] Password shared over a separate channel
- [ ] Original cover image deleted if you don't want comparisons possible
Try it yourself
If you want to experiment, PixelValut lets you hide and reveal AES-encrypted text in images, with processing done in your browser. I also wrote a shorter walkthrough on the site: how to hide messages in images. Alongside steganography, the site has free developer utilities like DNS and MX lookups, a JWT decoder, and an SSL checker that I use in my own work.
If you're looking for it later, just search for pixelvalut.com on Google.
Have you used steganography for watermarking, CTFs, or something unusual? I'd like to hear about it in the comments.
Top comments (0)