Introduction
BMP steganography hides a secret message inside a bitmap image by overwriting the least significant bit of each colour channel. Because BMP stores pixels uncompressed, flipping that one bit changes the colour by at most 1 part in 255, invisible to the eye, and no recompression step destroys the hidden data. This tool embeds a message into a 24-bit or 32-bit BMP and extracts it back, entirely in your browser. Upload an image, type your message, and download the stego file. Nothing is uploaded to a server.
What this tool does
- Hides a UTF-8 message in the least significant bit of each pixel byte of a 24-bit or 32-bit uncompressed BMP.
- Stores a 32-bit length prefix so the decoder knows exactly how many bytes to read back.
- Extracts a hidden message from a stego BMP by reading the LSBs and reconstructing the byte stream.
- Reports image dimensions, bit depth, and hiding capacity before you encode.
- Processes the file locally with the File API; no image data leaves the browser.
How this tool works
Upload a BMP and the tool parses the file header to find the pixel data offset, bit depth, and dimensions. For encoding, it converts your message to UTF-8 bytes, stores a 32-bit length prefix in the first 32 pixel-byte LSBs, then writes one message bit into the LSB of each subsequent pixel byte. The modified bytes are offered as a download so the image stays a valid, viewable BMP.
For decoding, the tool reads the 32-bit length prefix from the first 32 pixel-byte LSBs, then reads that many bytes from the following LSBs and decodes them as UTF-8. It validates the header and rejects compressed or unsupported bit depths with a clear error. The capacity readout tells you up front how many bytes the image can hide.
How BMP LSB steganography works
Least significant bit (LSB) substitution is the oldest and simplest image steganography technique. A 24-bit BMP stores each pixel as three bytes (blue, green, red). Changing the lowest bit of a byte alters the channel value by 0 or 1, which is imperceptible. A 1000x1000 24-bit BMP offers roughly 3.75 million pixel bytes, so it can hide about 469 KB of message data after the length prefix.
BMP is a good carrier because it uses no lossy compression. JPEG achieves its small file size by discarding and approximating high-frequency detail, which destroys LSB modifications on the next save. PNG is lossless and also works for LSB steganography, but BMP is simpler to parse and edit byte-for-byte, which is why it is a common teaching format. The Wikipedia article on steganography covers the broader technique.
This implementation uses a 32-bit big-endian length prefix so the decoder does not need to know the message length in advance. It only modifies the exact number of LSBs needed for the prefix plus the message, leaving the rest of the image untouched. For richer image steganography options, see the image steganography and binary image steganography tools.
How to use this tool
- Switch the mode to Hide message.
- Click Upload BMP and choose a 24-bit or 32-bit uncompressed BMP file.
- Type your secret message into the input field. The capacity readout shows how many bytes fit.
- Click Download stego BMP to save the modified image.
- To extract, switch to Extract message, upload the stego BMP, and the hidden text appears in the output.
Real-world examples
Embedding a passphrase in a vacation photo
A user wants to carry a 64-byte passphrase hidden in a 800x600 24-bit BMP (capacity about 180 KB). They upload the photo, type the passphrase, and download the stego BMP. The image looks identical to the original. They send it through any channel; the recipient uploads it to this tool, switches to extract, and reads the passphrase.
Verifying capacity before encoding
A team needs to hide a 2 KB message. They upload a 64x64 icon and the tool reports a capacity of only about 480 bytes. They switch to a 256x256 BMP, which reports about 7.6 KB of capacity, and the message fits. The capacity readout prevents failed encodes before they happen.
Detecting an unsupported file
Someone uploads a JPEG that was renamed to .bmp. The tool reports that the file is not a valid BMP (missing the 'BM' signature), making it clear the file is not actually a bitmap. They convert the image to a real 24-bit BMP in an image editor and retry.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| BMP LSB (this tool) | Lossless carrier, simple header | Teaching, small payloads, no recompression |
| PNG LSB | Lossless carrier, compressed container | Web-friendly lossless stego |
| JPEG DCT | Lossy carrier, frequency domain | Hiding in compressed photos (needs DCT tools) |
| Text / whitespace stego | No image needed | Hiding in documents or source code |
Limitations or considerations
LSB steganography in BMP is detectable by statistical analysis. Tools that measure the chi-squared statistic or the sample pairs of an image can flag an unusually uniform LSB plane, which is a sign of embedding. The stego BMP is also much larger than a JPEG of the same scene, which itself is a hint. This tool does not encrypt the message before embedding, so anyone who extracts the LSBs can read it. For real secrecy, encrypt the message first and then embed the ciphertext. The tool only supports uncompressed 24-bit and 32-bit BMPs; it rejects 8-bit palette BMPs, RLE-compressed BMPs, and other formats.
Frequently asked questions
Why does the tool reject 8-bit or compressed BMPs?
Eight-bit BMPs use a palette, and changing the LSB of a palette index can shift the colour dramatically rather than by 1. Compressed BMPs (RLE) do not store raw pixel bytes, so LSB substitution would corrupt the stream. The tool supports only 24-bit and 32-bit uncompressed BMPs, where LSB changes are imperceptible and safe.
Can someone tell that an image has a hidden message?
Yes. LSB embedding leaves statistical fingerprints that steganalysis tools detect by analysing the LSB plane. BMP LSB stego is a teaching technique, not a covert channel that resists analysis. Encrypting the message protects its content but does not hide the fact that embedding occurred.
How much data can I hide?
Roughly one byte per three pixel bytes for a 24-bit BMP, minus 4 bytes for the length prefix. A 1000x1000 24-bit BMP can hide about 469 KB. The tool shows the exact capacity for your uploaded image before you encode.
Is the message encrypted?
No. The message is embedded in plaintext into the LSBs. Anyone who extracts the LSBs can read it. Encrypt the message with a real cipher before embedding if confidentiality matters, then embed the ciphertext with this tool.
Conclusion
BMP steganography is the simplest way to learn how image-based hiding works: overwrite one bit per colour channel in an uncompressed bitmap and the message survives intact. Upload a 24-bit or 32-bit BMP above, type a message, and download the stego file to see the technique in action. For broader image stego options, try the image steganography tool, and for hiding data in text instead of images, see the whitespace steganography tool.