What it does
- Behind the picture. Anything after the end of the image is shown as a hex dump and can be downloaded as it is.
- Automatic layouts. It reads the lowest bit (and the lowest two) of the red, green and blue values in turn, of each color alone and of alpha, row by row and column by column, most or least significant bit first, directly or after a 4-byte length. Anything that starts with a known file type or 24 or more readable characters is listed.
- By hand. Pick the channels, bits, direction and bit order, and a number of bytes to skip, and the result updates live with a download button.
Reading the result
| You see | It means |
|---|---|
| Readable text | A message, probably. Check that it is sentences and not a pattern. |
| A file type (ZIP, PNG, PDF...) | A file starts here. Download it and open it on a computer you trust. |
| Random-looking bytes | No structure. Either nothing is hidden or the payload is encrypted or keyed. |
Be careful with what you extract
A hidden file can be anything, including a program. Do not open or run an extracted file you do not trust. The page only shows and offers the bytes; it never runs them.
Limits
- Lossy pictures (JPEG, most WebP) have noise in the low bits. Only the data behind the picture is dependable for them.
- Hiding with a password, or inside JPEG coefficients, is not read.
- We try the common layouts. A tool with its own layout will need the by-hand form, or its own program.
Not sure there is anything? Start with the Steganography Detector. Steps: how to find hidden data in an image. The page sends a copy of each picture to our server like every tool here (see the privacy policy).
Frequently asked questions
Is it safe to extract a hidden file?
Extracting only gives you bytes. Opening them is the risk: treat a hidden file like any unknown download.
Why does the manual form show garbage?
The layout does not match how the data was written. Try the other bit order, direction or channels, or skip the first bytes of a header.
Can it extract data hidden with steghide or OpenStego?
Not if a password was used. Those tools scramble the data with a key, so it does not read as text or a file here.