Stego Scanner

Steganography hides data inside images by modifying the least significant bits of pixel color values — changes too small for the human eye to notice. The Stego Scanner extracts these LSB planes and amplifies them to full brightness, revealing hidden patterns that indicate embedded messages, files, or encoded data. The tool also runs a chi-square test on the LSB distribution of each color channel to detect statistical anomalies characteristic of sequential bit embedding. Combined with Shannon entropy measurement, these techniques flag images that may carry covert payloads. For metadata-level forensics, use the Authenticity Checker alongside this tool.

OSINT researchers analyze images shared on social media and messaging platforms to detect covert communication channels. Law enforcement and digital forensics teams examine seized devices for hidden data in image files. Cybersecurity professionals scan incoming attachments for data exfiltration attempts disguised as ordinary photos. CTF (Capture The Flag) competitors use LSB analysis tools to solve steganography challenges. Journalists verify whether whistleblower-supplied images contain embedded metadata or hidden messages beyond visible content. For detecting AI-generated images, pair this with the AI Detector.

PNG and BMP are the best formats for steganography detection because they use lossless compression that preserves exact pixel values, including the least significant bits where data is typically hidden. JPEG uses lossy compression that alters pixel values during encoding, effectively destroying any LSB-embedded data — which is why the tool shows a warning for JPEG inputs. WebP lossless mode preserves pixel data and works well for analysis. If you receive a suspicious JPEG, the hidden data may have already been destroyed by compression, or the sender may have used a JPEG-aware steganography method that embeds data in DCT coefficients instead of pixel LSBs. For pixel-level manipulation detection beyond steganography, try the ELA Scanner.

The chi-square test groups pixel values into even-odd pairs and checks whether the distribution within each pair is balanced. In a natural image, these pairs show natural variation. Sequential LSB embedding forces pairs toward a 50/50 split, producing chi-square values converging to 1.0 across all channels — a strong indicator of hidden data. Shannon entropy measures how random the LSB values are on a scale from 0 to 1 bit. Natural images typically show high entropy (close to 1.0) because pixel noise is inherently random, but encrypted stego payloads push entropy even higher. When high entropy combines with chi-square values near 1.0, the probability of embedded data increases significantly. For file integrity verification, use the File Hash Scanner. To extract readable text and URLs from file bytes, try the String Extractor.