Two pictures. One of them is carrying a message. Look as hard as you like — you will not find it by eye, because hiding it changed each colour by a step or two out of 256.
Two choices: what to do to the message first, and where its bits go.
Same grid, top and bottom. One carries the text.
Got a picture you think is smuggling something? Drop it here.
The green picture on this toy's card in the Lab is 56 × 24 real pixels, and it's carrying a message. Download it, then open it here. It has to be a PNG: a JPEG blurs the colours slightly to save space, and that scrambles the last digits. The reader tries every way of hiding on this page by itself; if the message was locked, it needs the password.
The first pixels the message touched, in the order it touched them.
a binary digit that changed Each pixel holds 3 bits — one in red, one in green, one in blue.
| Px | Colour | Before (R G B) | In binary | After (R G B) | In binary | Bits hidden | Carries |
|---|
Every letter has a number. H is 72, e is 101. Written in binary, 72 is 01001000 — eight ones and zeros.
Each pixel is three numbers from 0 to 255: how much red, green and blue. So a colour is really three eight-digit binary numbers.
The last binary digit is worth 1 out of 255. Replace it with a digit from the message and the colour shifts by one — far below what an eye can see.
Collect the last digit of every channel in order, cut into groups of eight, turn each group back into a letter. The message walks straight out.
Letters aren't random: in plain text, the first bit of every byte is almost always 0. A detective who reads the last digits sees that pattern at once. Scrambled or encrypted bits look like coin flips, the same as an untouched photo.
A salt is a handful of random bytes mixed in with the password and stored, in plain sight, at the start of the hidden data. Without it, the same message and password would always hide the same bits, and someone comparing two pictures could tell. Press New salt and watch every hidden bit change.
Reading order packs the message into the top rows, where a detective looks first. Scattered, the bits land on pixels picked by the password, spread across the whole picture. Without the password you don't even know where to start.
Overwriting the last digit only ever swaps 2 with 3, 4 with 5, and so on, so pairs of colour values end up suspiciously equal: the "chi-square attack" (Westfeld and Pfitzmann, 1999) looks for exactly that. Nudging up or down at random instead hides that trace.
What happens to a pixel that's already as bright as it can be (255) or as dark (0), with no room to move one way? Nothing breaks: the colour simply moves the only way it can.
11111111, so hiding a 0 makes it 254 and hiding a 1 leaves it at 255. Black is the mirror image: 0 stays 0, or becomes 1. Using the last two digits, white lands between 252 and 255, black between 0 and 3.The catch: at the very top and bottom, nudging has no choice to make, so it acts exactly like overwriting, and its trick of going up or down at random is lost. A photo with a blown-out white sky or a solid black background is where a detector looks hardest: a sudden sprinkle of 254s in a sea of 255s is still invisible to the eye, but it stands out to a statistical test. That's why serious steganography tools skip pure white, pure black and large flat areas, and hide their bits in the busy, noisy parts of a picture instead.