Last updated:
Steganalysis Lab
Test an image for hidden data. The lab runs the chi-square LSB attack (the classic detector for least-significant-bit steganography) and Fridrich RS analysis to estimate payload size, visualizes every bit-plane, and reads the low bits in six common orders to recover plain-text payloads or embedded file signatures. Everything runs in pure JavaScript in your browser — your image is never uploaded.
How LSB steganalysis works
The most common image steganography hides data in the least-significant bit of each pixel. Embedding random (encrypted) data makes the counts of each value-pair (2k, 2k+1) converge, which the chi-square attack detects. Plotting the test over an increasing fraction of the image reveals sequential payloads — the curve stays high across the embedded region, then falls. The bit-plane view shows the LSB layer directly, where hidden data often looks like structured noise, and the lab also tries to read any plain-text written into the low bits. These are strong indicators for naive LSB tools, not a universal detector — adaptive or transform-domain steganography needs other methods.
Frequently asked questions
What can this detect?
Least-significant-bit (LSB) steganography in images — the most common kind used by free stego tools. It uses the chi-square attack, RS analysis, a bit-plane viewer, and LSB readers that look for text and file signatures in six bit orders. It will not reliably catch adaptive or transform-domain (e.g. JPEG DCT) steganography, which need other techniques.
What does the embedding probability mean?
It is the chi-square attack's estimate that value-pairs have been equalized by LSB embedding. Near 1 across part of the image strongly suggests hidden data there; near 0 suggests none. Natural images with very flat histograms can occasionally read high, so corroborate.
Is my image uploaded?
No. The analysis runs as plain JavaScript inside your browser (in a background Web Worker). Nothing is downloaded or uploaded, it works offline, and your image never leaves your device.
It found no hidden text — does that mean the image is clean?
Not necessarily. The readers only recover data stored as plain ASCII or a recognisable file header in one of six common row-major LSB orders. Encrypted, compressed or pseudo-randomly scattered payloads will not show as text even when the chi-square or RS statistics flag embedding.