HiddenInk is a hub of steganography tools — hide a text message or a file inside a PNG image, hide a secret inside ordinary-looking text using invisible zero-width characters, and reveal hidden data from an image or text with a universal extractor. Every operation runs entirely in your browser. Runs in your browser — your images and text never leave your device.

Uploading the image you are hiding a secret in defeats the point

Many incumbent steganography tools take a server upload of the very cover image you are trying to keep private — you have to trust them with it. HiddenInk takes the opposite approach: the image or text is read into your browser's memory, the payload is embedded there by Canvas 2D pixel manipulation and the browser's own Web Crypto implementation, and the result is written back out as a download. There is no backend, no upload, and no network request involved in any operation — you can verify this yourself in the DevTools Network tab.

Steganography is not encryption

Encryption (our sibling SealBox) makes data unreadable — it turns a message into ciphertext. Steganography hides the existence of data — it embeds a payload inside an ordinary-looking cover so an observer does not even know a message is there. They solve different problems and compose well: here, an optional password encrypts your payload with AES-256-GCM before embedding it, so even extraction needs the password. A forgotten password is unrecoverable by design.

What runs under the hood

Image tools use LSB (least-significant-bit) embedding: the low bits of the red, green, and blue channels of each pixel carry your payload, across a selectable bit-depth. The text tool maps your payload to four invisible Unicode zero-width characters. A self-describing frame — a magic header, version, length, and optional encryption key material — wraps every payload so extraction is exact and a wrong password is rejected cleanly by the GCM integrity check. There is no WASM, no third-party library, and no model — only the browser's built-in Canvas and Web Crypto.

The honest limits of LSB steganography

Two things you should know. First, LSB data is fragile: re-saving the PNG as JPEG, resizing, cropping, or passing it through social media re-encodes the pixels and destroys the hidden data. Keep and send the PNG uncompressed. Second, LSB is detectable: a dedicated steganalysis tool can flag that an image carries hidden LSB data. Steganography hides a message from casual viewing; it is not undetectable, and we will not pretend otherwise.

HiddenInk Pro — the optional one-time upgrade

Every core tool above is fully free: hide a message in an image, hide a file in an image, hide text inside text, and reveal any of them back. HiddenInk Pro is an optional, one-time license that adds three power tools, all still 100% in your browser: batch hide (the same message into many images, downloaded as a single .zip), an invisible watermark (tag an image's owner and detect it back without the original, for provenance and leak-tracking), and a steganography detector (a chi-square LSB heuristic that flags likely hidden data, with an LSB-plane preview). Pro also hides every ad. The free tier is not crippled — it never was.

Honest limits of the Pro tools: the watermark is fragile — JPEG, resize, crop, or social-media upload destroys it, and a determined adversary can strip it; it is deterrence, not forensic DRM. The detector is a heuristic — it can miss a tiny payload (false negative) or flag a naturally noisy photo (false positive), so its verdict is a hint, not proof. The license itself is a client-side checksum that deters casual copying; it is not DRM and needs no server.

Browse the tools

Image Steganography
Hide a message or file inside a PNG's pixels with LSB steganography.
Text Steganography
Hide a secret inside normal text using invisible zero-width characters.
Reveal & Extract
Reveal hidden data from an image or text — universal extractor.
HiddenInk Pro
Batch hide-to-zip, an invisible watermark, and an LSB steganography detector.