Tuxia Learn · ~6 min read
Image Steganography: Hiding Secrets in Pixels
"Steganography" comes from Greek for "covered writing". Unlike cryptography, which turns content into unreadable gibberish, steganography aims to hide the very fact that something is hidden — everything looks perfectly normal on the surface.
From acrostics to invisible ink
It's an old craft: acrostic poems hiding messages in first letters, spies writing in invisible ink on blank-looking paper, WWII "microdots" shrinking a page to the size of a period. The digital age gave us new "paper": images, audio and video.
Two schools of digital steganography
1. LSB (least significant bit). An image is made of pixels, each a number. Replace each number's lowest bit with secret data and the picture barely changes. Great concealment, but tiny capacity (~100+ KB per megapixel) — and the moment the image is compressed or transcoded, the lowest bits are rewritten and the data is gone.
2. Append-style. This is what Tuxia uses. PNG data officially ends at the IEND marker (GIF: 0x3B) — viewers stop there and ignore trailing bytes. So file data can simply be "written on" in that no-man's land. Big capacity and simple to implement; the price is a visibly larger file — anyone who knows will see "this image is off".
In short: LSB hides deep but carries little; append-style carries much but hides shallow. Tuxia chose the latter, because it solves "sharing files conveniently", not "defeating professional detection".
What Tuxia actually does
- Cover: your PNG / GIF / JPG, or a one-click random cover;
- Encryption (optional): with a password, PBKDF2 derives a key and AES-256-GCM encrypts the files — bank-grade; without the password it's gibberish;
- Packing: the encrypted files plus metadata (names, sizes, checksums) are appended after the image end marker.
Extraction reverses it: find the end marker, read the package, decrypt, restore the files. All in your browser — files never touch a server.
The limits: what it protects, what it doesn't
- It protects "invisibility": passersby see an ordinary picture and never suspect a thing;
- Real security comes from the password: steganography is the "hiding", encryption is the "lock". Without a password, anyone who knows the method can pull the files out;
- It does not survive compression: once WeChat, QQ or similar recompress the image, the trailing data is wiped — the inborn weakness of append-style hiding, and why Tuxia keeps nagging "send the original" (more here);
- It does not resist professional detection: abnormal file size and trailing entropy can both be flagged by analysis tools. Don't count on it against censorship or forensics.
A reminder: steganography is a neutral technology. Use it only lawfully — study, everyday file sharing, watermarking your work (full terms in
Terms of Service).
Try Tuxia →
Next: why WeChat/QQ "wash away" hidden files →
Related: Guide · FAQ