Hide a secret message in an image
Hide text inside an image, encrypt it with a password, then extract it again with the same tool. Everything happens in your browser; your image and message are never sent to a server.
- Runs on your device
- No upload
- No account
The image the message will be hidden in
Choose an image to see how many characters will fit.
Recommended. Without the password nobody can read the message. A forgotten password cannot be recovered.
An image prepared with this tool
What is steganography?
Steganography is the technique of hiding information inside another file so that its presence goes unnoticed. Encryption protects what a message says; steganography hides that there is a message at all. This tool uses both: it encrypts the text with a password, then places it inside the image.
How do attackers use steganography?
Attackers use the same technique. Known uses include:
- Hiding malicious code inside an innocent-looking image to get it past security filters
- Exfiltrating company data inside ordinary images
- Communicating unnoticed with a compromised device through images
That is why files that look like "just a picture" can carry risk too. File sharing rules and employee awareness are an important layer of defence against techniques like these.
How does this tool work?
In PNG format, the message is written into the last bit of each pixel's red, green and blue values. The change is invisible to the eye. In JPEG format, the message is added to the file's comment field, which does not affect the picture.
When you enter a password, the message is encrypted with AES-128 and its integrity is protected with HMAC-SHA256 (Fernet). The key is derived from your password with PBKDF2-SHA256 over 600,000 rounds. All of this happens in your browser.
Frequently asked questions
Is my image uploaded to a server?
No. Hiding, extracting and encryption all happen in your browser. Your image, message and password never leave your device.
Why did the hidden message disappear?
If the image is compressed, resized or converted to another format, the message is deleted. Messaging apps and social media usually recompress images. Send the file as an email attachment or a document.
Can I recover the message if I forget the password?
No. The password is not stored anywhere, and the message only opens with the right password.
Should I choose PNG or JPEG?
Choose PNG if it matters that the message goes unnoticed. Choose JPEG if you need to hide a long text, and always use a password.
How much text fits in an image?
In PNG format every 8 pixels carry about 3 characters. A 1920 × 1080 image holds about 770,000 characters. JPEG has no limit.