How to find hidden data in an image
The short answer
Check from the outside in: the file's size and format, its metadata, bytes behind the picture, readable data in the lowest bits, the bit statistics, and see-through pixels. The first three find most hidden data and are certain; the last two find more and are less sure. If all come back empty, you have ruled out the simple methods, not hiding with a key or inside JPEG.
This tutorial uses the free tools on this site: the Steganography Detector does steps 3 to 6 in one go, the Extract Hidden Data tool gets the data out, the Bit Plane Viewer lets you look, and the Metadata Viewer covers step 2. Always start from the original file: a re-save, screenshot or chat copy may have removed what you are looking for.
1. Look at the file
Is it the size you would expect? A 400 × 300 PNG of 3 MB, or a small JPEG that is far larger than its dimensions explain, deserves a look. The format matters too: for a JPEG, pixel-level tests mean nothing, and the steps below say which still apply.
2. Read the metadata
Open the picture in the Metadata Viewer. Text chunks, comments, XMP fields and odd Software values are the simplest hiding places, and nothing is hidden about them: they are readable. See EXIF data explained for what is normal.
3. Look behind the picture
Drop the file into the Steganography Detector. If bytes sit after the end of the image, it shows how many, what they start like (a ZIP, a PDF, a PNG) and a hex dump, with a download button. Some are innocent: phones add motion-photo video or maker data behind a JPEG, and the detector names those where it can.
4. Read the lowest bits
For PNG, BMP, TIFF and GIF, the detector reads the lowest bit (and two bits) of each channel in the usual layouts and looks for a known file type or readable text. A hit is a real finding: it shows the text or a hex dump and lets you download the bytes. If nothing is found automatically, open Extract Hidden Data and try the manual form: other channels, bit order, direction, or a few bytes skipped for a header.
5. Check the statistics
The bars in the detector show, for each channel, which stretches of the picture have their low bits evened out. A long red run from the start is what a payload leaves. It is only "possibly": in our test the same statistic fired on 5 of 48 AI PNGs and 2 of 66 real photos. Use it to decide where to look, not as a result.
6. Look at the planes, and the see-through pixels
The Bit Plane Viewer draws each bit as a picture. In bit 0 and 1, a shape, text, or a boundary between noise and smooth is a sign. For pictures with transparency the detector also reports see-through pixels that still carry color, which is where some tools put data.
When to stop, and what the answer means
| Result | What you can say |
|---|---|
| Text or a file extracted | "This picture contained X at Y." Open files carefully: they can be programs. |
| Bytes behind the picture, unrecognized | "There are N bytes after the image, which I cannot identify." They may be encrypted, or innocent maker data. |
| Only "possibly" from the statistics | "Nothing was readable; one statistic looked odd." That is not evidence of a payload. |
| Nothing | "The simple methods found nothing." Keyed hiding, JPEG-domain hiding and encrypted data can still be present. |
Other tools
On a computer you can go further with command-line tools: binwalk for files embedded or appended in a file, zsteg for LSB data in PNG and BMP, and steghide, which needs the password if one was set. Each does one thing our page does not, and they are the next step when this routine finds nothing and you still have a reason to suspect.
Look for data hidden in a picture: files appended behind it, text in the lowest bits of the pixels, data in transparent pixels. It runs in your browser. Open the Steganography Detector.
Frequently asked questions
Where should I start if I only have a minute?
Drop the file into the Steganography Detector. It checks behind the picture, the lowest bits and transparent pixels at once.
Why does my JPEG show less?
JPEG rewrites low bits, so only the data behind the picture and readable text are checked. JPEG-domain hiding needs other tools.
Is a hex dump of extra bytes dangerous to look at?
No. Showing bytes is safe. Opening or running an extracted file is the risk.