{"id":15659533,"url":"https://github.com/paulmillr/steg","last_synced_at":"2025-05-05T19:29:57.866Z","repository":{"id":42680909,"uuid":"510916743","full_name":"paulmillr/steg","owner":"paulmillr","description":"Simple and secure steganography","archived":false,"fork":false,"pushed_at":"2022-10-31T11:44:50.000Z","size":6500,"stargazers_count":27,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-30T23:05:08.446Z","etag":null,"topics":["aes","encryption","lsb","png","steganography","steganography-library"],"latest_commit_sha":null,"homepage":"https://paulmillr.com/apps/steg/","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/paulmillr.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-07-05T22:51:36.000Z","updated_at":"2025-03-29T14:32:59.000Z","dependencies_parsed_at":"2023-01-20T04:48:10.942Z","dependency_job_id":null,"html_url":"https://github.com/paulmillr/steg","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paulmillr%2Fsteg","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paulmillr%2Fsteg/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paulmillr%2Fsteg/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paulmillr%2Fsteg/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/paulmillr","download_url":"https://codeload.github.com/paulmillr/steg/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252562607,"owners_count":21768321,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aes","encryption","lsb","png","steganography","steganography-library"],"created_at":"2024-10-03T13:17:20.420Z","updated_at":"2025-05-05T19:29:57.823Z","avatar_url":"https://github.com/paulmillr.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Steg\n\n\u003e Simple and secure steganography\n\nEncrypt and hide arbitrary data inside png images. Experimental, use at your own risk.\n\n1. Encodes data using least significant bits of PNG pixels.\n2. Only PNGs are supported, JPGs cannot be used - every time you save them, they can get\n  re-encoded and some data would be lost, which is a no-go for steganography\n3. Encrypts hidden data and its metadata with AES-GCM-256. **Warning:** LSB `bitsTaken` are not encrypted for now.\n\nConsider an example, a `file.txt` with 11-byte `hello world` content. Here's a brief flow of what the library would do:\n\n1. Calculate the capacity of png image at given `bitsTaken` and save it into `capacity`\n2. Create a flat byte array structure with 5 fields ABCDE, that represents file and its metadata:\n    * A `bytes 0..1`  name length, 4GB max\n    * B `bytes 1..[1+name length]` name, 32 bytes max\n    * C `bytes B..B+4` file size length, 4GB max\n    * D `bytes C..[C+file length]` file contents\n    * E `bytes D..end` padding filled with zeros — zeros are okay, since we encrypt them\n3. Encrypt ABCDE under given AES key with AES-GCM-256:\n    * IV `bytes 0..12` taken from CSPRNG\n    * ciphertext `bytes 12..(end-16)` encrypted ABCD\n    * auth tag `bytes end-16..end` GCM authentication tag\n\nSo, in the end, 11-byte `hello world` text content would need at least 11 + 41 (1+8+4+12+16) bytes of capacity inside\nthe png under the given `bitsTaken`. In any case, it would consume the whole capacity e.g. 500KB and fill it with encrypted\nAES output in order to thwart detection.\n\n## Usage\n\n\u003e npm install steg\n\nCan be only used inside browsers. node.js usage with `node-canvas` that polyfills Canvas API is possible,\nbut had not been tested.\n\nCheck out demo inside `demo` directory, or at https://paulmillr.com/demos/steg/. There is also a 3rd party demo related to Decentralized Identifiers available at https://github.com/OR13/didme.me.\n\n### Hide a text file\n\nSelect a png image from the web page and uses it to hide `file.txt` containing `hello world`\n\n```ts\nimport { RawFile, StegImage, utils } from 'steg';\n\nconst file = new RawFile(utils.utf8ToBytes('hello world'), 'file.txt');\nconst encryptionKey = crypto.getRandomValues(new Uint8Array(32));\n\nconst el = document.querySelector('.user-avatar');\nconst png = new StegImage(el);\nconst hiddenPngUrl = await png.hide(file, encryptionKey);\n```\n\n### Use password to protect files\n\nUsing `@noble/hashes` library and Scrypt to derive AES key from an arbitrary password\n\n```ts\nimport { scrypt } from '@noble/hashes/scrypt';\nconst passwordBasedKey = scrypt('some-secure-password', 'secure-salt', { N: 2**19, r: 8, p: 1 });\nconst hiddenPngUrl = await png.hide(file, passwordBasedKey);\n```\n\n### Adjust bits used\n\n- `bitsTaken` (default: `1`) can be an integer from `1` to `8`. Lower values makes it harder to detect steganography.\n\n```ts\nconst hiddenBiggerPngUrl = await png.hide(file, encryptionKey, 5); // Uses 5 bitsTaken\n```\n\n### HTML file upload form\n\nThe form has two upload inputs: one for image inside which the data will be hidden, one for the data itself.\n\nIt also has the password and the bit range selector.\n\n```html\n\u003cp\u003e\u003cinput type=\"file\" id=\"image\" accept=\"image/*\" /\u003e\u003clabel for=\"image\"\u003eImage\u003c/label\u003e\u003c/p\u003e\n\u003cp\u003e\u003cinput type=\"file\" id=\"data\" disabled /\u003e\u003clabel for=\"data\"\u003eFile to hide inside image\u003c/label\u003e\u003c/p\u003e\n\u003cp\u003e\u003cinput type=\"password\" id=\"password\" disabled /\u003e\u003clabel for=\"password\"\u003ePassword\u003c/label\u003e\u003c/p\u003e\n\u003cp\u003e\u003cinput type=\"range\" id=\"bits\" min=\"1\" max=\"8\" value=\"1\" /\u003e\u003clabel for=\"bits\"\u003eBits taken\u003c/label\u003e\u003c/p\u003e\n\u003cdiv class=\"steg-output-container\"\u003e\u003cimg id=\"output\" /\u003e\u003c/div\u003e\n```\n\nForm script:\n\n```ts\nconst { RawFile, StegImage, utils } = steg;\nconst cache = {};\nconst el = (s) =\u003e document.querySelector(s);\nasync function hideDataIntoImage() {\n  if (!cache.password) return;\n  const bitsTaken = Number.parseInt(el('#bits').value);\n  const url = await cache.stegImg.hide(cache.hiddenFile, cache.password, bitsTaken);\n  await utils.setImageSource(el('#output'), url);\n}\nel('#password').addEventListener('change', (ev) =\u003e {\n  cache.password = ev.target.value;\n});\nel('#image').addEventListener('change', async (ev) =\u003e {\n  const img = await RawFile.fromFileInput(ev.target);\n  cache.stegImg = await StegImage.fromBytesOrURL(img.data);\n  el('#data').disabled = false;\n});\nel('#data').addEventListener('change', async (ev) =\u003e {\n  cache.hiddenFile = await RawFile.fromFileInput(ev.target);\n  hideDataIntoImage();\n});\nel('#steg-bits').addEventListener('change', (ev) =\u003e {\n  el('#steg-bits-value').textContent = ev.target.value;\n  hideDataIntoImage();\n});\n```\n\n## License\n\nMIT (c) Paul Miller [(https://paulmillr.com)](https://paulmillr.com), see LICENSE file.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpaulmillr%2Fsteg","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpaulmillr%2Fsteg","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpaulmillr%2Fsteg/lists"}