Steganography
It hides that there is a message.
If someone finds it, they can read it, unless it is also encrypted.
Hide text in an image
Write a message and hide it in a photo.
More resolution = more capacity to store data, but slower. "Original" uses the photo as is, with a maximum of 1024 px per side.
Stealth mode: leaves no «PSL1» mark or «stGo» chunk, and the bit positions come from your password. Without it you cannot even know whether there is data. Trade-off: a wrong password and "nothing here" give the same message, and it lives only in the pixels (any recompression destroys it).
Only changes what is drawn with the pixels (the letters or their binary, hexadecimal, Base64, Base32, Morse, ROT13 or Vigenère version). When decoding you always recover your original text.
With a password, ALL the hidden content is encrypted (AES-256-GCM, key from Argon2id). Without a password it is only hidden, not protected. If you forget it there is no way to recover it.
Video options (MP4)
This tool's lossless WebP stores every pixel exactly, but only in the pixels (no metadata) and without advanced compression: it is larger than PNG. Social networks recompress it anyway.
What does each button do?
- Generate: prepares the result with your photo and your content.
- Invert: for text and QR it swaps the light and dark areas of the shape; for images it gives the negative effect. It is saved like this when you download.
- Animate: shows how the pixels travel from the photo to form the result.
- Export GIF: saves that animation as a file (up to 512 px).
- Export video (MP4): saves the animation as a video at the image's original dimensions (or enlarged without smoothing), with the still photo at the start and the result at the end. It is lossy video (H.264, or VP9 if the browser cannot do H.264), but at a very high bitrate.
- Download PNG: the photo with the data hidden inside. Do not recompress it or upload it as a photo to a social network.
Original
Result
Select an image and generate.
Audio and video
Hide text or a file (up to 6 MB) in a WAV, MP4, MOV or M4A, or extract it. Everything happens in your browser.
Hide
Choose a file. WAV (lossless) stores in the audio samples; MP4/MOV stores in a box at the end of the file without touching the frames.
Choose an audio or video and write what to hide.
Extract
Choose a file to extract its content.
Extracted content
The video's frames and audio are not re-encoded. WAV: only the least significant bit of some samples changes (inaudible). An MP3, an OGG or a re-encoded video (social networks, ffmpeg) does NOT keep the data.
How it works
Everything is processed in your browser. Nothing is uploaded to any server.
The idea
The PNG you download is your photo (at the chosen resolution). Inside it carries very small instructions to rearrange its own pixels and form the text, the image, the QR or the file. When decoding, the page reads those instructions, moves your photo's pixels and shows you the result.
Hide text
Upload an image, write a message and press Generate. The lightest pixels of the photo are placed to form the letters. You can write it as normal text, binary, hexadecimal or Base64, with line breaks, and mark it as a link.
Hide image
Upload a source image and a target image. The source's pixels are rearranged according to the target's brightness to approximate its shape. You can choose Contain or Cover.
Hide QR
Write a URL or text. A QR is generated and formed with the photo's pixels. With "Force black/white" the result is a sharp, scannable QR; without forcing, it uses the photo's real colors (it needs a photo with enough light areas). You can also save the clean QR as a hidden file.
Hide file
Upload a file of up to 1 MB. It goes inside the PNG and, when decoding, a button appears to download it with its original name.
Decode
Upload the downloaded PNG (not recompressed). The page reads the instructions, rearranges the pixels with an animation and shows the text, the link, the file or the image. You can also download the result and repeat the animation.
Security: what it protects and what it does not
Without a password the content is hidden, not protected: anyone who knows this tool (or opens the PNG with a program) can read it. With a password everything is encrypted (text, image, QR and file) with AES-256-GCM; the key comes from your password with Argon2id (64 MiB of memory, 3 passes; resistant to graphics-card attacks). Old images with PBKDF2-SHA-256 (600,000 iterations) can still be read. If someone modifies the file, decryption fails instead of showing false data.
What remains visible even with a password: that the PNG carries embedded data, and its approximate size. A short or common password can be guessed by offline brute force: use a long phrase. There is no recovery if you forget it. Everything happens in your browser and the page makes no internet connection.
Where the data is stored
The data travels by two paths at once: in a block of PNG metadata and hidden in the least significant bit of the pixels' colors (a change of 1 out of 255, invisible). If an application deletes the metadata, the pixels still carry them. Before generating you will see how much capacity your photo has in pixels; if the content does not fit (for example a large file), only the metadata is used and the page tells you.
Performance
The heavy calculations (sorting pixels, encrypting, creating the PNG, the GIF and the animations) are done in a background process (Web Worker), so the page keeps responding and you can press Cancel. Under the button you will see which engine is in use. If your browser does not allow it, everything is done in the page itself with the same result, but with large images it may freeze for a few seconds. The Original (up to 1024 px) is the slowest and generates PNGs of several MB.
Accessibility and shortcuts
The menu works with the keyboard: Tab enters the list of sections and the arrow keys (or Home/End) change section. Images are enlarged with a click or with Enter/Space when focused. Warnings and errors are announced to screen readers; progress is announced in stages, not at every percentage. You can drag files onto the dashed-border boxes or paste an image with Ctrl+V. If you paste an image to decode, the clipboard may alter its pixels: if it does not work, use the downloaded PNG as is. The theme (light/dark) follows the system's until you change it; your choice is remembered in this browser.
Limits and warnings
It survives: deleting the metadata, or saving the PNG again losslessly. It does not survive: JPG, WebP or other lossy formats, scaling, cropping, filters or screenshots. WhatsApp, Instagram, Facebook and X usually recompress photos: share it as a file or document, not as a photo. Hidden files weigh up to 1 MB. Hiding data in the pixels is detectable with analysis tools: for confidentiality use a password.
Install and use offline
…
Audio and video
The "Audio and video" tab hides text or a file (up to 6 MB) in a WAV (low bit of the samples, inaudible) or in an MP4/MOV/M4A (a box at the end of the file; the frames are not touched). It is encrypted the same way as in images (AES-256-GCM, Argon2id) and stealth mode works the same. It does not survive MP3/AAC, re-encoding, remuxing with ffmpeg or social networks: send it as an attachment or in a zip.
Learn steganography
What it is, how information is hidden and what the page's text "languages" are for.
What is steganography?
Steganography is the art of hiding a message inside something else (a photo, an audio file, a video) so that nobody suspects it exists. It comes from Greek and means "hidden writing".
It is not the same as cryptography. Cryptography protects the meaning: you can tell there is a message, but you cannot understand it. Steganography protects the existence: the message cannot even be seen. The safest approach is to combine them and hide a message that is already encrypted.
Cryptography
It hides what the message says.
You can tell something is there, but without the key it cannot be understood.
Common techniques
Least significant bit (LSB)
Each colour of a pixel is a number from 0 to 255. Changing its last bit alters the colour by 1 point out of 255, which the eye cannot tell apart. With many pixels, a lot of data fits.
Metadata
Files have auxiliary areas (chunks in a PNG, boxes in an MP4) that programs ignore. It is easy to use, but any application that cleans metadata erases it.
Reordering elements
Instead of changing the pixels, their order is changed. The image keeps exactly the same colours and, when they are put back with the right instructions, they form the message. This is Pixel Stego's own technique.
Audio and video
The same idea applies: the low bits of a WAV's samples are inaudible, and an MP4 can carry an extra box at the end of the file.
How Pixel Stego does it
- You choose a photo and write the message.
- The page works out which pixels form the letters (or the QR, or the image) and stores the instructions to reorder them.
- If you set a password, everything is encrypted before being stored.
- The instructions are hidden in two ways: in a metadata chunk of the PNG and in the least significant bit of the colours. Stealth mode uses only the pixels and leaves no markers.
- The PNG you download looks like your photo. When you decode it, the page reorders the pixels with an animation and the message appears.
The text languages
In "Hide text" you can choose how the message is drawn with the pixels. These "languages" only change what is drawn: when decoding you always get your original text back. The examples use the word HOLA.
None of them is secure encryption. They are encodings or classic ciphers: they are for learning and playing, not for protecting secrets. That is what the password is for.
Binary
Each letter becomes eight zeros and ones (the bits of its UTF-8 code), separated by spaces. This is what the computer sees.
HOLA 01001000 01001111 01001100 01000001
Hexadecimal
The same bytes written in base 16 (0-9 and a-f), with two characters per byte. Widely used in programming.
HOLA 48 4f 4c 41
Base64
Splits the bytes into groups of 6 bits and writes them with 64 symbols (letters, numbers, + and /). It is used to send binary data as text and may end with = signs.
HOLA SE9MQQ==
Base32
Similar to Base64, but with 32 symbols (A-Z and 2-7), no lowercase and longer. It is easy to read and to dictate.
HOLA JBHUYQI=
Morse
Each letter is a sequence of dots and dashes, and words are separated by " / ". Accents are removed (Ñ is kept) and anything that does not exist in Morse is drawn as "?".
HOLA .... --- .-.. .-
ROT13
Each letter is shifted 13 places in the alphabet. Since the alphabet has 26 letters, applying it twice gives back the original text. It only changes the letters A-Z; everything else stays the same.
HOLA UBYN
Vigenère
A classic cipher from the 16th century, regarded as unbreakable for centuries but easily broken today. Each letter is shifted according to a letter of a keyword that repeats. It needs a key made of the letters A-Z and only changes the letters A-Z.
Key SOL · HOLA ZCWS
Real encryption: the password
To protect a secret, use a password. Pixel Stego encrypts everything with AES-256-GCM and derives the key with Argon2id (or with PBKDF2 if your browser cannot use WebAssembly). Without the password the content cannot be read, even if you know how the tool works.
A short or common password can be guessed by brute force: use a long phrase.
Good practices
- Use PNG and do not recompress it: JPG, lossy WebP, screenshots or social networks destroy the hidden data.
- Hide little: the more data you put in, the easier it is to detect with statistical analysis. Pixel Stego warns you when you go over 25 % of the capacity.
- A photo with detail and texture usually works better than a flat image.
- Do not use a photo that is already published: anyone who has the original can compare them.
- Choose a long password and do not send it through the same channel as the file.
- Stealth mode leaves no markers, but it requires the password and does not survive any recompression.
Myths and limits
- Hiding is not the same as protecting: if the message is not encrypted, anyone who knows where to look can read it.
- No technique is invisible forever: analysis programs exist that look for these traces.
- Pixel Stego is a tool for learning and personal privacy, not a certified system. Do not use it as the only protection for critical information.
- Use it responsibly and respect the law and other people's privacy.
About
Pixel Stego is a privacy tool that runs entirely in your browser.
What it is
Pixel Stego hides text, images, QR codes and files inside a PNG photo, a WAV audio file or an MP4 video, and reveals them again. It is meant for learning, playing and looking after your privacy.
Principles
- Everything is processed in your browser: nothing is uploaded to any server.
- No accounts, no cookies and no trackers.
- It works offline once loaded, and you can install it as an app.
- Available in Spanish, English and Portuguese.
- The libraries (QR, GIF, Argon2id) and the Outfit typeface are served from the page itself, with their licences.
The English and Portuguese translations were made by an AI and have not yet been reviewed by a native speaker.
Support the project
Pixel Stego is free to use. If you find it useful, you can support it with a voluntary donation on Ko-fi.
Support on Ko-fi(opens in a new tab)A creation of
LuckyFoox is the signature under which these pages and video games are published. Pixel Stego is the first.
Decode
Upload an image with hidden information to reveal it.
Content
Upload an image.