In 499 BCE, Histiaeus shaved a servant's head, tattooed a secret message on the scalp, waited for hair to regrow, and sent the servant to Aristagoras. The recipient shaved the head again and read the message. Herodotus records this in The Histories, Book 5. The technique worked not because the message was encrypted, but because no one suspected the carrier.
Steganography (from Greek steganos, covered, + graphia, writing) is the practice of hiding the existence of a message, not just protecting its content. The term entered print with Johannes Trithemius's Steganographia in 1499. Digital steganography applies the same principle to image files, audio files, and text — hiding data in the statistical noise of a cover medium so that no external observer knows communication is occurring.
Steganography vs. Cryptography vs. Watermarking
These three concepts are frequently conflated, but they serve different purposes.
Cryptography transforms a message so that an observer can see communication is occurring but cannot read the content without the key. An encrypted message is visibly ciphertext.
Steganography hides the fact that communication is occurring at all. An image file with a hidden message looks like an ordinary image to any observer who does not suspect steganography.
Digital watermarking is a related technique used to embed ownership or copyright information in media files, typically surviving compression and resizing. Unlike covert steganography, watermarking is often acknowledged — its goal is attribution, not secrecy.
The combination of steganography and cryptography is the strongest approach: encrypt the message first, then hide the ciphertext in a cover medium. An observer who suspects steganography and extracts the hidden data finds only ciphertext, not plaintext.
Digital Steganography Techniques
LSB image steganography
The most widely implemented technique. Digital images store pixels as RGB or RGBA values — three or four bytes per pixel. The least significant bit (LSB) of each byte contributes minimally to the visual appearance. A value of 200 (binary: 11001000) looks identical to 201 (binary: 11001001) to the human eye — the difference is one unit in a 0–255 range.
By replacing the LSB of each byte with one bit of the hidden message, you can embed data at a rate of 1 bit per channel per pixel. A 1920×1080 pixel RGB image has 1,920 × 1,080 × 3 = 6,220,800 bytes. Using the LSB of each byte gives 6,220,800 bits = 777,600 bytes = approximately 759 KB of hidden capacity with no perceptible visual change.
Our Image Steganography tool implements LSB encoding and decoding on PNG files.
Zero-width character steganography
Unicode defines several characters with zero visual width: Zero Width Space (U+200B), Zero Width Non-Joiner (U+200C), Zero Width Joiner (U+200D), and Word Joiner (U+2060). These characters are invisible in most text renderers and are not stripped by common copy-paste operations.
A binary message can be encoded by substituting zero-width characters for bits: Zero Width Non-Joiner = 0, Zero Width Joiner = 1. The resulting character sequence is invisible when embedded between normal text. Copy-pasting the document preserves the hidden characters. The Zero-Width Character Steganography tool encodes and decodes these sequences.
Text and whitespace methods
Text steganography uses formatting rather than content. Methods include: - Trailing whitespace at line ends (spaces = 0, tabs = 1) - Word spacing variations - Letter spacing adjustments - Homoglyph substitution (replacing Latin letters with visually identical Unicode characters from other scripts)
The Whitespace Steganography tool and Text Steganography tool implement these patterns.
Steganalysis: How Hidden Data Is Detected
Steganalysis is the detection and extraction of hidden data. It mirrors cryptanalysis in structure: just as frequency analysis exploits statistical regularities in ciphertext, steganalysis exploits statistical anomalies introduced by embedding.
LSB histogram analysis: An unmodified image has a smooth histogram of pixel values. LSB embedding disturbs this distribution in a characteristic way — pairs of values (200, 201) tend toward equal frequency because the LSB is being overwritten with message bits. This creates a "pairs of values" signature detectable with a chi-square test.
RS analysis: Jessica Fridrich's RS (Regular-Singular) steganalysis, published by the Digital Forensics Research Group at Binghamton University, is more sensitive than histogram analysis. It classifies groups of pixels as Regular (their LSB manipulation increases complexity), Singular (manipulation decreases complexity), and uses the ratio of these groups to estimate the embedding rate, even below 10% capacity.
Universal steganalysis: Machine learning classifiers trained on features extracted from image DCT coefficients (for JPEG) or spatial domain statistics (for PNG) can detect steganography at embedding rates below 5% with high accuracy. Academic research from 2015 onward has pushed detection sensitivity to very low payload sizes.
The practical implication: LSB steganography in images is detectable by an adversary who runs standard steganalysis tools on suspected carrier files. It provides security through obscurity, not through any mathematical guarantee.
Practical Applications
Digital watermarking: Content publishers embed ownership information in media files to track unauthorised distribution. Watermarks are designed to survive compression, cropping, and colour adjustment. Unlike covert steganography, watermarks are acknowledged by the media owner.
CTF challenge categories: Steganography is a standard challenge category in Capture the Flag competitions. Common challenge types: - Find text hidden in an image using LSB tools - Extract zero-width characters from a text file - Identify homoglyph substitutions in a document - Decode audio steganography from a WAV file
Journalism and source protection: Steganography has been proposed for secure source communication, but its use in this context carries significant risk. If an adversary suspects communication is occurring and has access to the carrier files, steganalysis reveals the hidden data. Proper source protection requires operational security measures beyond steganography.
Limitations
Steganography does not encrypt data. A message hidden in an image using LSB steganography is plaintext once extracted. Any adversary who detects the steganography and extracts the payload reads the message immediately.
The payload capacity is limited by the cover medium. LSB image steganography at 1-bit-per-byte in a small image (say, 200×200 pixels) hides only about 15 KB. Attempts to embed more data at higher density increase the statistical anomalies and make detection easier.
Steganography provides security against a passive observer who does not suspect hidden communication. It does not provide security against a targeted adversary who is specifically looking for hidden data. For adversaries that matter, steganography should be combined with strong encryption.