{% extends "base.html" %} {% block title %}About - Stegasoo{% endblock %} {% block content %}
About Stegasoo

Stegasoo hides encrypted messages and files inside images using multi-factor authentication.

Features
  • Text & File Embedding
    Any file type: PDF, ZIP, documents
  • Multi-Factor Security
    Photo + passphrase + PIN/RSA key
  • AES-256-GCM Encryption
    Authenticated encryption with integrity check
  • DCT & LSB Modes
    JPEG resilience (DCT) or high capacity (LSB)
  • Random Pixel Embedding
    Defeats statistical analysis
  • Large Image Support
    Up to {{ max_payload_kb }} KB, tested with 14MB+ images
  • Zero Server Storage
    Nothing saved, files auto-expire
  • QR Code Keys
    Import/export RSA keys via QR
  • Channel Keys v4.1
    Group/deployment isolation
Embedding Modes

Two modes optimized for different use cases.

DCT Mode Default

DCT (Discrete Cosine Transform) embeds data in frequency coefficients. Survives JPEG recompression.

  • Capacity: ~75 KB/MP
  • Output: JPEG or PNG
  • Color: Color or grayscale
  • Speed: ~2s
  • Error Correction: Reed-Solomon v4.1
Instagram, Facebook
WhatsApp, Signal, Telegram
Twitter/X
Any recompressing platform
LSB Mode

LSB (Least Significant Bit) embeds data in the lowest bit of each color channel. Imperceptible to the eye.

  • Capacity: ~375 KB/MP
  • Output: PNG (lossless)
  • Color: Full color
  • Speed: ~0.5s
Email attachments
Cloud storage
Direct file transfer
Social media
Comparison
Aspect DCT Mode Default LSB Mode
Capacity (1080p) ~50 KB ~770 KB
Survives JPEG ✅ Yes ❌ No
Social Media ✅ Works ❌ Broken
Detection Resistance Better Moderate
Auto-Detection: Mode is detected automatically when decoding.
How Security Works

Multi-factor authentication derives encryption keys:

Reference Photo
Something you have
~80-256 bits
Passphrase
Something you know
~44 bits (4 words)
Static PIN
Something you know
~20 bits (6 digits)
RSA Key
Optional
~128 bits
Combined entropy: 144-424+ bits. 128 bits is infeasible to brute force.
Key Derivation

{% if has_argon2 %} Argon2id 256MB memory cost. Memory-hard KDF defeats GPU/ASIC attacks. {% else %} Argon2 Not Available Using PBKDF2-SHA512 with 600k iterations. Install argon2-cffi for stronger security. {% endif %}

Channel Keys v4.1

Channel keys provide deployment/group isolation. Messages encoded with one channel key cannot be decoded with a different key, even if all other credentials match.

Auto

Uses server-configured key if available, otherwise public mode.

  • Set via STEGASOO_CHANNEL_KEY env var
  • Or channel_key in config file
  • All users share the same channel
Public

No channel key. Compatible with other public installations.

  • Default if no server key configured
  • Anyone can decode (with credentials)
  • Interoperable between deployments
Custom

Your own group key. Share with recipients.

  • Format: XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX
  • 32 chars (128 bits entropy)
  • Private group communication
{% if channel_configured %}
This server has a channel key configured: {{ channel_fingerprint }} ({{ channel_source }})
{% else %}
This server is running in public mode. Set STEGASOO_CHANNEL_KEY to enable server-wide channel isolation.
{% endif %}
Share Channel Key via QR

Generate a QR code to share a channel key with others.

Version History
Version Changes
4.1.0 Reed-Solomon error correction for DCT mode (corrects up to 16 byte errors per 223-byte chunk), majority voting on length headers, improved robustness with problematic carrier images
4.0.0 Channel keys for group/deployment isolation, DCT default, simplified auth, passphrase replaces day_phrase, 4-word default, JPEG fix, large image support, subprocess isolation, Python 3.10-3.12
3.2.0 Single passphrase, more default words
3.0.0 DCT mode, JPEG output, color preservation
2.2.0 QR code RSA key import/export
2.1.0 File embedding, compression
2.0.0 Web UI, REST API, RSA keys
1.0.0 Initial release, CLI only, LSB mode
Usage Guide

  1. Agree on a reference photo (never transmitted)
  2. Go to Generate to create credentials
  3. Memorize passphrase and PIN
  4. If using RSA, store the key file securely
  5. Share credentials via secure channel

  1. Go to Encode
  2. Upload reference photo and carrier image
  3. Choose mode:
    • DCT (default): social media
    • LSB: email, cloud, direct transfer
  4. Enter message or select file
  5. Enter passphrase and PIN/key
  6. Download stego image

  1. Go to Decode
  2. Upload reference photo
  3. Upload stego image
  4. Enter passphrase and PIN/key
  5. View message or download file
Mode is auto-detected.
Limits & Specs
Max text 2M characters
Max file {{ max_payload_kb }} KB
Max carrier 24 MP (~6000x4000)
DCT capacity ~75 KB/MP
LSB capacity ~375 KB/MP
Max upload 30 MB
File expiry 5 min
PIN 6-9 digits
RSA keys 2048, 3072, 4096 bit
Passphrase 3-12 words (BIP-39)
Python Version 3.10-3.12
Built with Flask, Pillow, NumPy, SciPy, jpegio, cryptography, argon2-cffi
{% endblock %} {% block scripts %} {% endblock %}