STEGASOO(1)

NAME
stegasoo - steganography with hybrid authentication

SYNOPSIS
stegasoo [-v|--version] [--json] [-h|--help] command [args]

DESCRIPTION
stegasoo hides messages and files in images and audio using PIN + passphrase security. It uses LSB (Least Significant Bit) steganography with optional DCT (Discrete Cosine Transform) encoding for JPEG resilience, and supports audio steganography with LSB and Spread Spectrum modes.

Messages are encrypted using a hybrid authentication scheme that combines a reference photo (shared secret), passphrase, and PIN code.

GLOBAL OPTIONS

-v, --version
    Show version and exit.

--json
    Output results as JSON (where supported).

-h, --help
    Show help message and exit.

COMMANDS

  encode
Encode a message or file into an image.

stegasoo encode carrier -r reference [-m message | -f file] [options]

-r, --reference PATH
    Reference photo (shared secret). Required.

-m, --message TEXT
    Message to encode.

-f, --file PATH
    File to embed instead of message.

-o, --output PATH
    Output image path.

--passphrase   TEXT
    Passphrase (recommend 4+ words). Prompts if not provided.

--pin   TEXT
    PIN code. Prompts if not provided.

--dry-run
    Show capacity usage without encoding.

Examples:
    stegasoo encode photo.png -r ref.jpg -m "Secret" --passphrase --pin
    stegasoo encode photo.png -r ref.jpg -f doc.pdf -o encoded.png

  decode
Decode a message or file from an image.

stegasoo decode image -r reference [options]

-r, --reference PATH
    Reference photo (shared secret). Required.

--passphrase   TEXT
    Passphrase. Prompts if not provided.

--pin   TEXT
    PIN code. Prompts if not provided.

-o, --output PATH
    Output path for file payloads.

Examples:
    stegasoo decode encoded.png -r ref.jpg --passphrase --pin
    stegasoo decode encoded.png -r ref.jpg -o ./extracted/

  generate
Generate random credentials (passphrase + PIN + optional channel key).

stegasoo generate [options]

--words   INTEGER
    Number of words in passphrase (default: 4).

--pin-length   INTEGER
    PIN length (default: 6).

--channel-key
    Also generate a 256-bit channel key.

Examples:
    stegasoo generate
    stegasoo generate --words 6 --pin-length 8
    stegasoo generate --channel-key

  info
Show version, features, and system information.

stegasoo info [--full]

--full
    Show full system information (CPU, temperature, disk on Pi).

  batch
Batch operations on multiple images.

stegasoo batch subcommand [args]

batch encode
    Encode message into multiple images.

    stegasoo batch encode images... [-m message | -f file] [options]

    Options: -m, -f, -o/--output-dir, --suffix, --passphrase, --pin, -r/--recursive, -j/--jobs, -v/--verbose.

batch decode
    Decode messages from multiple images.

    stegasoo batch decode images... [options]

    Options: -o/--output-dir, --passphrase, --pin, -r/--recursive, -j/--jobs, -v/--verbose.

batch check
    Check capacity of multiple images.

    stegasoo batch check images... [-r/--recursive]

  channel
Manage channel keys for deployment isolation.

Channel keys bind encode/decode operations to a specific group or deployment. Messages encoded with one channel key can only be decoded by systems with the same channel key.

stegasoo channel subcommand [args]

channel generate
    Generate a new random channel key.

    Options: --save (project config), --save-user (user config).

channel show
    Show the current channel key.

    Options: --key TEXT (show specific key instead).

channel qr
    Display channel key as QR code.

    Options: --key TEXT, --format [ascii|png], -o/--output PATH.

channel status
    Show channel key status and configuration.

channel clear
    Remove channel key configuration.

    Options: --project, --user.

  admin
Web UI administration commands.

stegasoo admin subcommand [args]

admin generate-key
    Generate a new recovery key (for reference only).

    Options: --qr (show QR code in terminal).

admin recover
    Reset admin password using recovery key.

    Options: --db PATH (path to stegasoo.db), --password TEXT.

  audio-encode
Encode a message or file into an audio file.

stegasoo audio-encode audio -r reference [-m message | -f file] [options]

-r, --reference PATH
    Reference photo (shared secret). Required.

-m, --message TEXT
    Message to encode.

-f, --file PATH
    File to embed instead of message.

-o, --output PATH
    Output audio path.

--passphrase   TEXT
    Passphrase (recommend 4+ words). Prompts if not provided.

--pin   TEXT
    PIN code. Prompts if not provided.

--mode   [lsb|spread]
    Embedding mode: lsb (default) or spread (spread spectrum).

Examples:
    stegasoo audio-encode song.wav -r ref.jpg -m "Secret" --passphrase --pin
    stegasoo audio-encode podcast.mp3 -r ref.jpg -f doc.pdf --mode spread

  audio-decode
Decode a message or file from a stego audio file.

stegasoo audio-decode audio -r reference [options]

-r, --reference PATH
    Reference photo (shared secret). Required.

--passphrase   TEXT
    Passphrase. Prompts if not provided.

--pin   TEXT
    PIN code. Prompts if not provided.

-o, --output PATH
    Output path for file payloads.

Examples:
    stegasoo audio-decode stego.wav -r ref.jpg --passphrase --pin
    stegasoo audio-decode stego.wav -r ref.jpg -o ./extracted/

  audio-info
Display audio file information and steganographic capacity.

stegasoo audio-info audio [--json]

Shows format, sample rate, channels, bit depth, duration, and embedding capacity for both LSB and Spread Spectrum modes.

Examples:
    stegasoo audio-info song.wav
    stegasoo audio-info podcast.mp3 --json

  tools
Image security tools.

stegasoo tools subcommand [args]

tools capacity
    Show steganography capacity for an image.

    stegasoo tools capacity image [--json]

tools exif
    View or edit EXIF metadata.

    stegasoo tools exif image [--clear] [--set FIELD=VALUE] [-o PATH] [--json]

tools peek
    Check if image contains Stegasoo hidden data.

    stegasoo tools peek image [--json]

tools strip
    Strip EXIF/metadata from an image.

    stegasoo tools strip image [-o PATH] [--format [png|bmp]]

ENVIRONMENT

STEGASOO_CHANNEL_KEY
    Channel key for encode/decode operations. Overrides config file settings.

STEGASOO_HTTPS_ENABLED
    Enable HTTPS for web UI (Docker/service mode).

STEGASOO_HOSTNAME
    Hostname for SSL certificate generation.

FILES

~/.stegasoo/channel.key
    User's channel key configuration (encrypted).

.stegasoo.toml
    Project-level configuration file.

frontends/web/instance/stegasoo.db
    Web UI SQLite database (accounts, settings).

EXAMPLES

  Basic encode/decode workflow
# Generate credentials
stegasoo generate
# Encode a secret message
stegasoo encode vacation.png -r selfie.jpg -m "Meet at noon"
# Decode the message (on another system with same reference photo)
stegasoo decode vacation_steg.png -r selfie.jpg

  Using channel keys for team isolation
# Generate and save a channel key
stegasoo channel generate --save-user
# Share the key with your team
stegasoo channel qr -o team-key.png
# Now all encode/decode operations use this channel
stegasoo encode photo.png -r ref.jpg -m "Team secret"

  Batch processing
# Check capacity of all PNGs in a directory
stegasoo batch check ./photos/*.png
# Encode same message into multiple images
stegasoo batch encode ./photos/ -r ref.jpg -m "Secret" -o ./encoded/

SECURITY
Stegasoo uses multiple layers of security:

•   Reference photo provides a visual shared secret

•   Passphrase (recommend 4+ words) for strong encryption

•   PIN code adds additional entropy

•   Channel keys isolate different deployments

•   AES-256 encryption for payload data

For maximum security, share the reference photo out-of-band (in person, secure messenger) and use a strong passphrase.

SEE ALSO
openssl(1), qrencode(1)

BUGS
Report bugs at: https://github.com/adlee-was-taken/stegasoo/issues

AUTHOR
Written by the Stegasoo contributors.

COPYRIGHT
Copyright © 2024-2026. MIT License.