Hide a message inside a picture PHANTOM

Encrypted first, hidden second

The order matters more than anything else on this page. Your text is encrypted with AES-256-GCM before a single bit of it goes near the picture, under a key stretched from your passphrase with PBKDF2-SHA256 over 310,000 iterations against sixteen random bytes of salt. Only then is the ciphertext written into the image.

So the hiding is a second line of defence rather than the only one. Somebody who works out that the picture carries a payload (and that is not hard, see below) gets ciphertext, and is back to guessing a passphrase. A tool that hid a secret without encrypting it first would be security by obscurity and nothing else, and obscurity is the part that fails.

The payload goes into the lowest bit of every red, green and blue channel, four bytes of length first. Alpha is left alone, because changing it produces visible artefacts. That gives a capacity of three bits per pixel: about 180 KB in a twelve-megapixel photograph, and about 46 KB in the small generated cover.

PNG or nothing

Download the carrier as PNG and keep it as PNG. JPEG is a lossy format: compressing an image throws away exactly the low-order detail the payload lives in, and it does so silently. A carrier re-saved as JPEG holds nothing, and you find out when you try to open it.

This is not only about the Save As dialogue. Most messaging apps and most social networks re-encode every image you send through them, and many resize it as well; either destroys the payload completely. So does an image optimiser, a CMS that generates thumbnails, and a mail client that helpfully shrinks attachments. If the carrier has to travel, it has to travel as a file: a zip, an attachment that is not processed, a disk. Extraction never rescales an image on the way in for the same reason: resampling rewrites every low bit there is.

What this hides from, and what it does not

Least-significant-bit steganography hides the payload from a person looking at the picture. It does not hide it from somebody testing for it. The low bits of a photograph are not random: they carry the sensor's noise, and that noise has structure. Replacing them with ciphertext, which is statistically flat, is a detectable change, and the standard tests for it have existed for twenty-five years. STEGOSCAN runs some of them, on this site, in the browser, which should tell you how high the bar is.

What that means in practice: this is good for getting a recovery key past something that looks at filenames and file types, or for storing one among your own photographs where nobody thinks to look. It is not good against an adversary who suspects steganography and has your files. If being seen to be hiding something is itself the danger, consider that a picture with a flat low-bit histogram is evidence of exactly that.

The other two tools in this group hide differently and fail differently. PALIMPSEST also works on images; GLYPH hides a note inside ordinary text using characters that do not render, which survives copy and paste but not a strip of invisible characters, and UNSEEN finds those. If you want the contents unreadable and do not need the fact of them concealed, CIPHER is simpler, stronger, and has nothing to destroy it.