Stegasoo is a secure steganography tool that hides encrypted messages and files inside ordinary images using multi-factor authentication.
Stegasoo uses hybrid multi-factor authentication to derive encryption keys:
{% if has_argon2 %}
Argon2id Available
Using Argon2id with 256MB memory cost — the winner of the Password Hashing Competition
and current best practice for key derivation.
{% else %}
Argon2 Not Available
Falling back to PBKDF2-SHA512 with 600,000 iterations.
Install argon2-cffi for stronger security.
{% endif %}
Uses LSB (Least Significant Bit) embedding with pseudo-random pixel selection. The pixel locations are determined by a key derived from your credentials, making the hidden data's location unpredictable without the correct inputs.
New in v2.1 Stegasoo now supports embedding any file type, not just text messages.
FastAPI Stegasoo includes a complete REST API built with FastAPI, featuring automatic documentation, type validation, and comprehensive error handling.
POST /generate – Generate credentialsPOST /encode – Encode text message (JSON)POST /encode/file – Encode binary file (JSON)POST /encode/multipart – Encode with file uploadsPOST /decode – Decode message (JSON)POST /decode/multipart – Decode with file uploadsPOST /extract-key-from-qr – Extract RSA key from QRPOST /image/info – Get image capacityGET / – API status and capabilities/encode/multipart endpoint returns the PNG image directly
(with headers indicating metadata), while /decode/multipart returns JSON.
Use --output flag to save responses to files.
// Generate credentials
curl -X POST "http://localhost:8000/generate" \
-H "Content-Type: application/json" \
-d '{"use_pin": true, "use_rsa": false, "pin_length": 6, "words_per_phrase": 3}'
// Encode text message (images must be base64 encoded first)
// First encode images: base64 -w0 photo.jpg > photo.b64
curl -X POST "http://localhost:8000/encode" \
-H "Content-Type: application/json" \
-d '{
"message": "secret message",
"reference_photo_base64": "'"$(cat photo.b64)"'",
"carrier_image_base64": "'"$(cat carrier.b64)"'",
"day_phrase": "apple forest thunder",
"pin": "123456"
}'
// Encode file (base64) - encode file first: base64 -w0 document.pdf > doc.b64
curl -X POST "http://localhost:8000/encode/file" \
-H "Content-Type: application/json" \
-d '{
"file_data_base64": "'"$(cat doc.b64)"'",
"filename": "document.pdf",
"reference_photo_base64": "'"$(cat photo.b64)"'",
"carrier_image_base64": "'"$(cat carrier.b64)"'",
"day_phrase": "apple forest thunder",
"pin": "123456"
}'# Encode text with file uploads
curl -X POST "http://localhost:8000/encode/multipart" \
-F "day_phrase=apple forest thunder" \
-F "pin=123456" \
-F "reference_photo=@photo.jpg" \
-F "carrier=@carrier.png" \
-F "message=secret" \
--output stego.png
# Encode file (no message field when using payload_file)
curl -X POST "http://localhost:8000/encode/multipart" \
-F "day_phrase=apple forest thunder" \
-F "pin=123456" \
-F "reference_photo=@photo.jpg" \
-F "carrier=@carrier.png" \
-F "payload_file=@document.pdf" \
--output stego.png
# Encode with RSA key from QR code (optional)
curl -X POST "http://localhost:8000/encode/multipart" \
-F "day_phrase=apple forest thunder" \
-F "pin=123456" \
-F "reference_photo=@photo.jpg" \
-F "carrier=@carrier.png" \
-F "message=secret" \
-F "rsa_key_qr=@keyqr.png" \
--output stego.png
# Decode with file uploads (returns JSON)
curl -X POST "http://localhost:8000/decode/multipart" \
-F "day_phrase=apple forest thunder" \
-F "pin=123456" \
-F "reference_photo=@photo.jpg" \
-F "stego_image=@stego.png" \
--output result.json
The API can extract RSA keys from QR code images. QR code reading requires
pyzbar and libzbar system library.
# Extract key from QR code (returns JSON)
curl -X POST "http://localhost:8000/extract-key-from-qr" \
-F "qr_image=@keyqr.png"/docs for Swagger UI or /redoc for ReDoc documentation.
All endpoints include detailed schemas and example requests.
Stegasoo also includes a full-featured CLI. Install with pip install stegasoo[cli]
or see the CLI documentation for complete usage.
# CLI Examples
stegasoo generate --pin --words 3
stegasoo encode -r photo.jpg -c meme.png -p "phrase" --pin 123456 -m "secret"
stegasoo decode -r photo.jpg -s stego.png -p "phrase" --pin 123456
stegasoo info image.png{% if has_argon2 %}Argon2 Available{% else %}PBKDF2 Fallback{% endif %} {% if has_qrcode_read %}QR Reading Available{% else %}QR Reading Not Available{% endif %}
abc123_20251228.png).
Use this to determine which day's phrase to use!
| Max text message | 2 million characters (~2 MB) |
| Max file payload | {{ max_payload_kb }} KB |
| Max carrier image | 24 megapixels (~6000×4000) |
| Max upload size | 30 MB |
| Temp file expiry | 5 minutes |
| PIN length | 6-9 digits |
| RSA key sizes | 2048, 3072, 4096 bits |
| Phrase length | 3-12 words (BIP-39 wordlist) |
| API documentation | /docs (Swagger) and /redoc |
| QR code support | RSA key encoding/extraction (up to 3072 bit keys) |
Stegasoo v{{ version }} • Open Source • Built with Python, FastAPI, and cryptography