Reveal text hidden in PNG images
Reads messages hidden with LSB steganography in the red channel. Pair with the steganography encoder. Runs locally.
image/png · runs locally · nothing uploaded
How it works
Pick an image, tune the options, then download the result. Everything runs in your browser.
- 01
Load PNG carrier
Use a PNG produced by the steganography encoder. JPEG can't carry LSB bits.
Files stay in memory as an
HTMLImageElement— the original bytes are never uploaded, and EXIF metadata is preserved until you explicitly transform it.inputuploadcanvaslocaldecodecarrier · bytesPNG · loadedload: image/png
loaded · decodedcanvas · ready - 02
Read 32-bit length header
The first 32 pixels carry a big-endian length prefix telling us how many bytes follow.
Encoder quality is exposed where the format supports it — JPEG and WebP get a
0–1quality slider; PNG is lossless. Options re-render the canvas immediately.headeroptionslive previewencoderqualityheader · tunable32 bits · livelen = read32bits(LSB)
options applied · liveencoder · live - 03
Read payload bits
The next
len × 8red-channel LSBs are reassembled into bytes.Pixel work runs on the Canvas 2D context —
drawImageresamples with the browser’s bilinear filter andgetImageData/putImageDataback per-pixel passes.bitsrenderCanvas 2Dpreviewpx-perfectbits · resampled? · px-perfectbytes = read(len × 8 bits)
preview · livepx-perfect - 04
Decode as UTF-8
Bytes are decoded with permissive UTF-8 so partial data still surfaces something useful.
Downloads ship via a hidden anchor with an object URL — no server round-trip, and the file on disk is untouched. The output filename inherits a sensible suffix.
decodedownloadblobclient-sideobject URLok · blobready · savedutf8.decode(bytes)
shipped · ready to shipsuccess
Browser-only image work that scales
Convert with quality control
JPEG/WebP let you pick a 0–1 quality. Default 0.92 is a good compromise of size and visible quality.
PNG isn’t free
Use PNG only for transparency or sharp edges. For photos, WebP is smaller at the same perceived quality.
Strip EXIF for privacy
Photo EXIF often contains GPS, camera model, and timestamps. Strip before sharing public uploads.
Watch the colour profile
Convert to sRGB before web export. Wide-gamut images render oversaturated in non-managed browsers.
AVIF when it’s available
AVIF beats WebP on size at the same quality. Detect support via <picture> with fallbacks.
Lazy-load below the fold
Add loading="lazy" on <img>. The browser handles scheduling — no IntersectionObserver needed.
When to use this tool
Common workflows it speeds up.
CTF / CTF prep
Decode beginner CTF challenges with LSB payloads. Decoded into a Canvas 2D context — original bytes never leave the tab, so you can process customer-uploaded photos, internal screenshots, or sensitive diagrams without privacy concerns.
px-perfectWatermark verify
Read back hidden authorship markers you embedded. Encoders expose quality 0–1 where the format supports it (JPEG, WebP); PNG and AVIF stay perceptually lossless. Pick 0.85 for web, 0.95 for archival, 0.7 for thumbnails.
quality-tunableHidden notes
Decode small text passed alongside images. Pair with the EXIF Stripper before sharing user-uploaded photos publicly. Camera serial numbers, GPS coordinates, and timestamps often hide in image metadata and leak more than the picture itself.
format-awareTampering check
Confirm an image's hidden checksum survived transmission. Output preserves colour profile (sRGB) so it renders consistently across browsers, monitors, and print pipelines. Wide-gamut workflows can opt into Display P3 for modern Apple devices.
EXIF-safeTeaching tool
Demo what LSB steganography really looks like. Re-runs only on option changes, never on window resize, so the canvas stays responsive on large images. drawImage uses the browser's bilinear filter for fast resampling.
client-sideForensic peek
Quick sanity check before reaching for heavier tools. Downloads as .png, .jpg, .webp, or .avif with the correct MIME so editors apply native handling on save. The filename inherits a sensible suffix derived from the input.
compression-readyFrequently asked questions
Something missing?
Tell us what you need. We ship the top requests every two weeks.