How to how lsb steganography works: a technical implementation guide
- Step 1Calculate capacity — Capacity in bytes = (width × height × channels) ÷ 8. For a 1024×1024 RGBA image using 3 channels: (1024 × 1024 × 3) ÷ 8 = 393,216 bytes. Leave headroom — embedding at full capacity is detectable.
- Step 2Encode — Iterate pixels in raster order. For each message byte, write its 8 bits one per LSB of successive colour channel values. Append a null byte (00000000) to mark the end of the message.
- Step 3Decode — Iterate pixels in the same raster order. Extract one LSB per channel, assemble 8-bit groups, and collect bytes until you encounter a null terminator.
Frequently asked questions
Why use only 1 bit per channel?+
Using 1 bit per channel limits the maximum pixel value change to ±1, which is imperceptible. Using 2 bits doubles capacity but introduces visible colour banding in flat-colour regions of the image.
How does the null terminator work?+
After the last message byte, the encoder writes 8 zero-value LSBs (a null byte) as an end-of-message marker. The decoder reads LSBs until it collects 8 consecutive zeros, then stops.
Why does the tool use Canvas2D instead of reading the PNG bytes directly?+
Canvas2D getImageData provides a decoded RGBA pixel array independent of the PNG encoding variant (interlaced, filter type, etc.). Direct PNG byte parsing would require implementing a full PNG decompressor — Canvas2D handles this via the browser's built-in image engine.
Privacy first
Every JAD Security operation runs entirely in your browser. Files, passwords, and PGP private keys never leave your device — verified by zero outbound network requests during processing.