Question 1

What is LSB steganography and how does this tool implement it?

Accepted Answer

LSB (least significant bit) is the technique of replacing the least important bits of each color byte with bits of your content, a change small enough that the eye usually cannot tell. This tool uses 1 to 4 of those bits in each red, green and blue channel of every pixel (the alpha channel is never touched), preceded by a 14-byte header with the magic number "STG1", a version, the content size and a CRC-32 checksum to validate extraction.

Question 2

Why is the output image always PNG, even if I upload a JPEG?

Accepted Answer

Because PNG is lossless: it preserves every bit exactly as it was written. Lossy JPEG and WebP re-encode the image in blocks and discard exactly the tiny color variations where the data is hidden, so saving the result in those formats wipes the message out. The tool accepts JPEG or WebP as the input carrier image, but always delivers the result as PNG, and any later attempt to save it in another lossy format destroys the hidden content.

Question 3

How many bytes fit inside my image?

Accepted Answer

Capacity in bits is (width x height x 3 color channels) x bits per channel, minus the 14-byte header. A 1000x1000 pixel image, for example, has 3 million color-channel bytes available: at 1 bit per channel that is about 375 KB of usable capacity, at 4 bits per channel it reaches about 1.5 MB. The tool computes that exact number for your image and warns you before you try to embed something larger than it fits.

Question 4

What changes when I raise the bits per channel from 1 to 4?

Accepted Answer

Every extra bit doubles the data capacity, but it also increases how much each pixel changes, which can become visible in flat, low-detail color areas. In general, 1 or 2 bits per channel produces a PSNR above 50 dB (imperceptible to the naked eye), 3 bits lands in the 35 to 50 dB range (subtle, noticeable in a side-by-side comparison or when zoomed in), and 4 bits can fall below 35 dB on images with little color variation, where the noise already shows.

Question 5

Is this tool's password encryption actually secure?

Accepted Answer

Yes: the content is encrypted with AES-256-GCM (which provides both confidentiality and authenticity), from a key derived from your password via PBKDF2-SHA256 with 210,000 iterations, and a random salt and initialization vector different on every use. The password itself is never stored anywhere, it is only used to derive the key at the moment of encrypting or decrypting. Without the correct password, extraction fails cleanly, without revealing whether the failure was a wrong password or corrupted data, so it cannot serve as an oracle for someone trying to guess it.

Question 6

What happens if I compress, resize, or post the image on social media?

Accepted Answer

The hidden content disappears. LSB does not survive any reprocessing: lossy recompression, resizing (which interpolates pixels and blends their values), and the automatic reprocessing WhatsApp, Instagram, Twitter/X and most social networks apply to every uploaded image all destroy the least significant bits where the data is stored. For the content to survive, the PNG needs to be transferred as a file, without going through any recompression step.

Question 7

How does Detect mode work, and does it find any kind of steganography?

Accepted Answer

Detect mode does two things: first, it tries all 4 possible bits-per-channel values looking for this very tool's "STG1" header; if found, it shows whether the content is encrypted and how large it is, and lets you jump straight to extraction. Second, it runs a general statistical analysis (a histogram of the least significant bits and the Westfeld and Pfitzmann chi-square pairs-of-values test) that indicates how much the image resembles a full-blown LSB substitution, even if it is not in this tool's own format. Treat this as a hint, not proof: noisy natural photos can also score low without hiding anything, and hiding data in only a small part of the image weakens the statistical signal.

Question 8

Does any of my data (image, message, password) ever leave my browser?

Accepted Answer

No. All the pixel reading, bit encoding and decoding, encryption and final PNG generation happen locally, via the browser's own Canvas and Web Crypto API. Nothing is sent to a server, not the image, not the hidden content, not the password.

Image Steganography