How to Hide Secret Text in Images (Steganography Guide)
Steganography hides a message inside something that looks ordinary, so the message travels without anyone suspecting it exists. This guide shows how text gets tucked into an image’s pixels and how to hide and reveal your own secret message, free and entirely in your browser. Nothing you upload leaves your machine.
How it works
Every pixel in an image carries color as three numbers: red, green, and blue, each from 0 to 255. Written in binary, a value like red 200 is 11001000. The rightmost digit is the least significant bit (LSB): flipping it changes 200 to 201 (11001001), a difference of one unit out of 255. Your eye cannot see it, and neither can most software that compares the two images casually.
LSB steganography exploits exactly that slack. It takes your message, breaks it into bits, and writes those bits into the last bit of one color channel per pixel, replacing the near-invisible noise that was already there.
Take the letter “H”. Its byte value is 72, which is 01001000 in binary. Those 8 bits get written one at a time into the least significant bit of 8 consecutive pixels (or 8 consecutive channels, depending on the layout). The first pixel’s LSB becomes 0, the next 1, then 0, 0, 1, 0, 0, 0. The decoder walks the same pixels in the same order, reads the last bit of each, reassembles 01001000, and recovers “H”. Repeat for every character and you have the full message stored invisibly across the image.
How much can you hide
Capacity depends on how many pixels the image has and how many channels you write to. One bit per channel per pixel means 8 pixels store one character in single-channel mode. Using red, green, and blue together roughly triples the room. Rough real-world numbers:
| Image size | Red channel only | Full RGB |
|---|---|---|
| 100 x 100 px | ~1.2 KB | ~3.6 KB |
| 1280 x 720 px | ~115 KB | ~345 KB |
| 1920 x 1080 px | ~259 KB | ~778 KB |
Our encoder lets you pick the channels: Red (default, the most discreet since it touches the fewest bits), RGB for about triple the capacity, or RGBA for about four times when the alpha channel is available. A short note fits in a tiny thumbnail; a long document wants a full-resolution photo in RGB.
Hide a message
Load an image, type your text, and download the result as a PNG.
- Upload an image (a photo or any picture works).
- Type the message you want to hide.
- Optionally switch to RGB if you need more room than the red channel alone gives.
- Optionally set a password to encrypt the message.
- Click Encode & Download.
The output is always a PNG. That is not a style choice: PNG is lossless, so it stores every pixel bit exactly as written. JPEG is lossy. It recompresses the image and rewrites pixel values to save space, which scrambles the least significant bits and destroys the hidden data. Never re-save a stego image as JPEG.
Reveal a message
Drop the PNG in and read whatever is hidden inside it.
- Drop the PNG onto the decoder.
- Read the hidden text it extracts.
- If the message was password-protected, type the password to unlock it.
The decoder does not assume the file came from our encoder. It auto-detects many common LSB layouts: the R, G, B, RGB, or RGBA channels, length-prefixed or null-terminated messages, and MSB or LSB bit order. It validates strictly, so an ordinary photo with no hidden payload returns nothing rather than a page of garbage.
Add a password (encryption)
Hiding and encrypting solve two different problems, and using both is stronger than either alone. Steganography hides the fact that a message exists at all. Encryption makes the message unreadable even if someone finds it.
When you set a password, the message is encrypted with AES-256-GCM before it is written into the pixels, with the key stretched from your password using PBKDF2. Without the password the embedded bits look like random noise and reveal nothing. A wrong password also reveals nothing: GCM includes an authentication tag, so the decoder can tell the key is wrong and refuses to output a bogus result instead of guessing.
So an unprotected stego image hides your note but shows it plainly to anyone who runs it through a decoder. A password-protected one stays hidden and, even if the LSB trick is spotted, stays unreadable.
Limits and common mistakes
Be honest with yourself about what this does and does not survive.
- PNG only, lossless only. The technique depends on exact pixel values. Keep the file as PNG the whole way.
- Re-saving or screenshotting destroys it. Convert the PNG to JPEG, run it through an image optimizer, or take a screenshot, and the least significant bits change. The message is gone.
- Many apps recompress silently. Most chat apps and social networks re-encode images on upload to save bandwidth, which strips the payload. Share the PNG as a file attachment or through a channel that does not recompress, not as an inline photo in a feed.
- It is LSB steganography, not a universal detector. The decoder reads LSB layouts. It will not extract messages hidden by other methods, such as JPEG/DCT-domain steganography, which stores data in frequency coefficients rather than pixel bits.
Frequently asked questions
Is it private? Yes. Both tools run entirely in your browser using the Canvas API. The image and your message are processed locally on your device and nothing is uploaded to a server, so no one else ever sees the file or the text.
Can I use any image? Almost. Any picture works as a carrier, but the result is saved as PNG, and you must keep it as PNG. Bigger images hold more text, and switching to RGB or RGBA raises capacity. If your message does not fit, use a larger image or add more channels.
Will the encoded image look different? Not to the eye. Only the least significant bit of the chosen channels changes, a shift of at most one unit out of 255 per channel. Side by side the two images look identical.
Can anyone read it without the password? If you set a password, no. The message is encrypted with AES-256-GCM, so without the correct password the pixels read as noise and a wrong password returns nothing. Without a password, anyone who runs the PNG through an LSB decoder can read it, so add a password when the content is sensitive.
Ready to try it? Hide your text with the Steganography Encoder and pull it back out with the Steganography Decoder.