LSB steganography explained
The short answer
Each color value in a picture is eight bits, and the last one, the least significant bit (LSB), changes a value by at most 1 out of 255, which nobody can see. LSB steganography overwrites those bits with data. A bit plane viewer shows the low planes as noise with a pattern where data was written, and a chi-square test finds that embedded random bits even out the counts of neighboring values. It only works on lossless pictures, and encrypted payloads look random either way.
The idea
A pixel's red value of 200 is binary 11001000. Change the last bit to 1 and it is 201: the pixel looks identical. Do that for every red, green and blue value and a 1000 × 1000 picture holds 3 million bits, about 375 KB, in a change nobody can see. That is LSB steganography. Reading it back is the same walk: take the last bit of each value, in the same order, and join the bits into bytes.
The details that differ between tools are what you need to try when extracting: which channels, how many bits (1 or 2 per value), the walk order (rows or columns), the bit order inside each byte, and a header such as a length. Our Extract Hidden Data tries the common combinations and lets you set them by hand.
What bit planes show
A bit plane is one bit position of one channel, drawn black and white. The top planes draw the picture's outline. The lowest plane of a natural photo is noise, since the sensor cannot measure the last bit. With data hidden in it:
- Message shorter than the picture: the plane is noise at the top where bits were replaced and looks different below, since the message starts at the first row.
- Picture-sized message: noise everywhere, so it looks like a normal photo, which is why statistics are needed.
- A picture hidden in a picture: the low planes show a faint shape.
Look at them yourself with the Bit Plane Viewer.
The chi-square test
In a natural picture, the counts of neighboring values 2k and 2k+1 differ (a sky has many 120s and few 121s, say). Overwriting the last bit with random bits makes both values equally likely, so the counts become equal. The chi-square test (Westfeld and Pfitzmann, 2000) measures how equal the pairs are. We apply it to stretches of the picture in reading order: a payload written from the top gives a run of equalized stretches from the start, then normal values below.
How well it works: our test
We hid payloads in five photos. The test flagged all five with random bits in every pixel and four of five with 20% filled, and flagged one of five clean copies. Reading the bits back found the planted text and ZIP file in every photo, and no false text or file in 208 real and AI pictures. On those 208 pictures the statistic fired on 5 of 48 AI PNGs and 2 of 66 real photos decoded from JPEG, which is why it is shown as "possibly" and never as proof.
| Payload | Found by reading the bits | Flagged by the statistic |
|---|---|---|
| Text message | 5 of 5 | often not (a short message changes few bits) |
| Small ZIP file | 5 of 5 | often not |
| 20% of the picture, random | no structure to read | 4 of 5 |
| Whole picture, random | no structure to read | 5 of 5 |
Where it fails
- Lossy formats. JPEG destroys low bits, so tools hide data in its coefficients instead, a different method.
- Keys. A tool that encrypts or scatters the bits with a password leaves random-looking bits in random places.
- Small payloads. A few hundred bits in a big picture change nothing a statistic can see. Only reading the bits in the right layout finds them.
- Natural flat or dithered pictures. Pictures with processed or limited value ranges can look "evened out" without any payload.
See each bit of each color channel of a picture as its own black and white image, to spot hidden structure in the low bits. It runs in your browser. Open the Bit Plane Viewer.
Frequently asked questions
Why can I not see the change?
Changing a value by 1 out of 255 is far below what the eye can tell apart, and the changes are random in sign.
Does converting to JPEG destroy LSB data?
Yes. JPEG rewrites the pixel values, so the hidden bits are lost. That is why people share such pictures as PNG.
Can the statistic prove there is a payload?
No. It shows the low bits are unusually even. Only extracting readable text or a file is proof.