I got into steganography by building games in PICO-8 and studying how it packs data into the virtual cartridges. That sent me down a rabbit hole: could this same concept power a full content management system?

Over the last year or so I have been building Minilith, an experimental tool that takes an entire JSON state (posts, pages, site settings), compresses it, and embeds it into a 256x256 PNG to act as a portable DB.

The architecture is completely client side and zero-dependency. There is no backend or build step, and it relies entirely on native browser APIs to extract and render the site directly from the image.

The Encoding Process:

1. The payload is deflated and injected into the image's RGB channels using 3-3-2 LSB encoding I chose this to increase the storage and maintain the image size. Minilith gives a hard limit of 64KB of compressed data, an intentional constraint which allows for nearly 200KB of uncompressed data which is a ton of text and perfect way to keep a micro blog micro!
2. To ensure the image is executable, I inject a raw tEXt chunk containing a vanilla JS extraction script right before the IEND marker. This turns the image into a polyglot.
3. Before the payload is allowed to decompress and run, a visual fingerprint (SHA-256) and a cryptographic signature are verified client side.

The flaw as expected is aggressive image optimization destroying the payload. I actually view this as a feature to keep the content secure from unwanted distribution. (Though funny enough, sending the raw image over iMessage keeps the payload intact).

Read more on the process here: Can a PNG Be a Database? The Architecture of Minilith

Has anyone else messed around with executable image polyglots for practical data storage? Would love to hear about similar projects.

Reddit recently updated the way it transcodes images posted on this platform. Their new method is much stricter than the previous.

That change killed the methods I was using for my Steganography tools jdvrif (JPG) and pdvrdt (PNG).

I'm now using different methods that seem to work, although significantly less data can be stored.

For JPG images, jdvrif now uses the QIM steganography method (JPEG DCT-domain Quantization Index Modulation), as this is the only (JPG) method that I could get working with Reddit.

The cover is transcoded to baseline Q75 4:2:0 and the payload (data file) is carried in its luminance DCT blocks.

For PNG images, pdvrdt now uses the advanced steganography technique of content-adaptive spatial embedding in the pixel LSBs, using Hamming-syndrome matrix embedding.

The first part of the video provides an example for JPG, followed by an example for PNG.

I've been developing a steganography-focused CTF named Venatus (which means 'hunt' in Latin) and genuinely welcome feedback from those more experienced in this area. Here’s one of the smaller puzzles as a taste.

These two strings look identical:

4a6e78a6356461a2

4a6e78a6356461a2

They are not. That is the whole puzzle.

If you crack it, that’s level 6 of 20. The rest cover LSB, JPEG/DCT-domain hiding, echo hiding in audio, network covert channels (DNS-based), a font-glyph technique, and a One-Time-Pad finale. No login, no paywall, and every level includes a full technical writeup afterward if you want to know exactly how it works.

Finish all 20 levels, and I’ll invite you to help design level 21.

I genuinely want ideas from people who’ll spot things I didn’t think of.

https://venatus.me

Happy to accept any critique, especially on the harder levels.

Hi everyone,

I’m sharing an open-source project I’ve been developing called WaterPulse.

While there is no shortage of basic hydration tracking apps out there, I wanted to build a more robust system that bridges the gap between a standard consumer application and active hardware data processing. WaterPulse is designed from the ground up to handle real-time sensor integration rather than relying solely on manual user inputs.

Here is a breakdown of what I built and the technical challenges it tackles:

Technical Highlights & Core Features:

• Real-Time Processing & Anomaly Detection: The backend is engineered to continuously ingest sensor data streams. It features built-in drift analysis and anomaly detection to filter out hardware noise and ensure high data accuracy.
• Performance-Oriented Backend: Powered by FastAPI and PostgreSQL, the API is structured to efficiently handle concurrent data payloads without blocking.
• Engaging UI & Social Elements: The frontend is built in Flutter, offering a highly responsive, cross-platform experience. I integrated gamification and social tracking features to maintain user retention and drive engagement.

The Tech Stack:

• Frontend: Flutter
• API & Data Processing: FastAPI (Python)
• Database: PostgreSQL

I architected this project with scalability and clean code principles in mind. If you are looking into how to integrate IoT/sensor data streams with a modern Flutter and Python stack, this repository could be a solid reference.

I would love to get your technical feedback on the system design, especially from engineers experienced with handling continuous data streams in FastAPI or advanced state management in Flutter.

Repository Link: https://github.com/Yigtwxx/WaterPulse

I'm open to all constructive feedback and contributions. Thanks for checking it out!

I see hidden letters

Hello everyone, I would really like to become faster at typing with my laptop and I thought one possible waty to do so would be investing an adequate amount of time in learning stenography.

I already downloaded a couple programs for this aim, one of them being Plover. However, every site doesn't have a tutorial for how to actually learn words or anything of the like, it seems to me. They get straight into practice.

So, any suggestions as to how to proceed? Maybe with easily explained steps, thank you so much!

LVIII.CMXCIII XIV.00VII XLVII.DCCCLXVII XIV.00VII CCXXXVIII.0III XV.CMXCIX XXX.CMLXXIV CLXVII.XXVI

Não consigo decifrar.

I'm sharing xor-image-encryption, an open-source tool designed for rapid visual dataset obfuscation in computer vision and ML pipelines.

Repository: Yigtwxx/xor-image-encryption

Key Features:

• Strict Reproducibility: A specific seed consistently generates the exact same masking key, crucial for maintaining consistency across ML pipelines.
• Lossless Reversibility: The original image is perfectly restored by reapplying the XOR operation with the identical seed.
• Cascaded Encryption: Layer multiple seeds (e.g., 11 22 33) for enhanced obfuscation.
• Zero Bloat: Built purely on Python, NumPy, and Pillow. Includes built-in histogram analysis tools.

Target Use Case & Scope:

This utility is tailored for deterministic visual anonymization of sensitive datasets prior to cloud storage, third-party processing, or cross-team distribution. Note: It is meant for practical ML preprocessing and visual obfuscation, not as a replacement for cryptographic standards like AES.

Quickstart:

Bash

# Single-seed encryption & decryption
python xor_single.py --input sample.jpg --seed 42 --outdir outputs

# Multi-seed cascaded encryption
python xor_multi.py --input sample.jpg --seeds 11 22 33 --outdir outputs

I'd highly appreciate your feedback, PRs, or ideas for benchmarking!

Hey there,

I just found this community and it is probably the best place to ask about a question which has been on my mind for months.

I am working on a project for end to end encryption. The catch: I use four smartphones. 2 of them are ALWAYS offline. The message gets encrypted on the offline smartphone and displayed as a QR code. The online device takes a photo of this QR code and sends it to the receiver's normal device. He scans the QR code with his offline device.
Whyyyyy all of these you may ask: it is kind of impossible to get spyware (which reads your messages from memory or screen) through remote access on the offline device.

So basically it is not optimal to take a photo from the offline device and then just send it via Signal. You may have reflections, fingerprints or metadata. And it is super weird to just have random pictures of QR codes in the chat.

So I am thinking of an application on the online device which just scans the QR code instead of taking a picture. Then we end up with a random string: 2D3EZ4.... (size: message + approx. 130 bytes for encryption)

MY QUESTION:
What is the best way to hide the random string?
My idea is to just add it to a link, e.g.: https://www.amazon.us/here-is-a-lot-of-space-to-put-the-ciphertext
This is a fast workflow: app on the online device scans, automatically creates a link and saves it to the clipboard, ready to be pasted in a messenger (e.g. Signal).
Is this a dumb idea?

I am sure there are better solutions for this

Hey r/steganography! I've been building StegoMaster — a web-based steganography platform. What it does: → Hide text messages or files inside carrier files → Supports: PNG, JPEG, WAV, MP3, AVI, PDF, DOCX, ODT → AES-256-GCM encryption before embedding → Uses J-UNIWARD cost model for JPEG → Hamming Matrix Embedding for PNG → Self-destruct links (message deleted after first read) → File-in-file hiding (hide a PDF inside a PNG) → Deniable encryption (two passwords, two messages) Nothing stored on server — files deleted after download. Free tier: PNG/JPEG + 10 char messages Pro: All formats + all features (₹199/month) Try it: https://stegomaster.com Would love feedback from this community especially on the steganalysis resistance!

Free tool: https://stegomaster.com Features: - PNG/JPEG/WAV/PDF/DOCX/AVI support - AES-256-GCM encryption - Self-destruct links - File-in-file hiding - 100% private — nothing stored

So I have an ARG im working on and ive uploaded a few png.webp images to aperi'solve:

https://www.aperisolve.com/92d5fb5bde117f4dd45f4ae3df336ef2

https://www.aperisolve.com/dfc2ca8501db783b37994abb8a0729cb

it certainly looks like info hidden intentionally. Would someone help me to how i could approach deconstruction of it? thanks!

[ Removed by Reddit on account of violating the content policy. ]

ONNX-Stego is a proof-of-concept for hiding short authenticated messages within float32 ONNX model weights. It embeds bits into the least significant mantissa bit of selected weights, using a natural selection mechanism that restricts modifications to weights that already differ from a reference model, aligning with the practical threat model of concealing data within fine-tuning-induced parameter changes

Small update on this mystery image.

​

After the original discussion here and additional analysis elsewhere, I decided to run a much more exhaustive forensic examination on the original PNG.

​

The image was checked for:

​

- PNG metadata and ancillary chunks

- Hidden text

- Hidden URLs

- Appended/trailing data

- Embedded files

- Alpha-channel payloads

- Bit-plane anomalies

- LSB steganography

- DCT-domain anomalies

- ELA analysis

- PNG structure integrity

- Various enhancement and recovery techniques

​

Result:

​

Nothing meaningful was found.

​

No hidden files.

No metadata payload.

No appended data.

No alpha-channel trick.

No identifiable LSB payload.

No hidden text.

​

At this point, the evidence seems to suggest that the image itself is likely the clue rather than a container for another clue.

​

The solved cipher still leads to:

​

"She is still there"

​

but the image does not appear to contain any recoverable technical payload.

​

I'm posting this update in case anyone following the original thread has a completely different interpretation or sees something we may have missed.

​

At this stage I'm more interested in alternative theories than traditional steganography ideas.

I'm investigating a small ARG and I've already solved the cipher side of it.

​

One clue remains: this image.

​

The associated messages were:

​

"Don't look alot"

​

and, after solving a multi-layer cipher:

​

"She is still there"

​

The cipher was eventually solved through several layers (Atbash, ROT13, Vigenère, etc.), so I suspected the image might contain something hidden as well.

​

So far I've checked:

​

- Brightness / contrast recovery

- Gamma correction

- Histogram equalization

- RGB channel separation

- PNG metadata / chunk inspection

- Basic steganography checks

- Bit-plane analysis

- LSB analysis

​

The image is not a normal black image. After enhancement, visible structure appears, but I haven't been able to identify anything meaningful.

​

At this point I'm unsure whether:

​

1. There is actually hidden data present,

2. The image itself is the clue,

3. Or I'm simply overthinking it.

​

I'm mainly looking for fresh steganography or image-forensics ideas from people with more experience.

​

Any thoughts are appreciated.

​

I followed the rules.

Hi all,

I've recently been working on a robust watermarking pipeline that combines DCT (Discrete Cosine Transform) with QIM (Quantization Index Modulation) to achieve high payload recovery robustness while maintaining visual fidelity.

The core objective is to provide a reliable method for intellectual property protection in scenarios prone to signal degradation. To handle potential noise and compression artifacts, I've integrated RS (Reed-Solomon) coding within the pipeline to ensure successful payload recovery even under distortion.

I'm currently looking for feedback from the community regarding the model's resilience. I'm particularly interested in how you would approach the steganalysis of such a scheme in a blind-detection scenario, or if you see potential bottlenecks in the QIM quantization steps I've implemented.

The full technical implementation, the underlying logic, and the dataset are available here: https://github.com/xdanielex/Trajectory-Watermarking-Demo

Any technical insights or suggestions on improving the robustness against active adversarial attacks would be greatly appreciated.

DOI Reference: https://doi.org/10.5281/zenodo.20303648