STEGASOO(1)

NAME
stegasoo - steganography with hybrid authentication

SYNOPSIS
stegasoo [-v|--version] [--json] [-h|--help] command [args]

DESCRIPTION
stegasoo hides messages and files in images using PIN + passphrase security. It uses LSB (Least Significant Bit) steganography with optional DCT (Discrete Cosine Transform) encoding for JPEG resilience.

Messages are encrypted using a hybrid authentication scheme that combines a reference photo (shared secret), passphrase, and PIN code.

GLOBAL OPTIONS

-v, --version
    Show version and exit.

--json
    Output results as JSON (where supported).

-h, --help
    Show help message and exit.

COMMANDS

  encode
Encode a message or file into an image.

stegasoo encode carrier -r reference [-m message | -f file] [options]

-r, --reference PATH
    Reference photo (shared secret). Required.

-m, --message TEXT
    Message to encode.

-f, --file PATH
    File to embed instead of message.

-o, --output PATH
    Output image path.

--passphrase   TEXT
    Passphrase (recommend 4+ words). Prompts if not provided.

--pin   TEXT
    PIN code. Prompts if not provided.

--dry-run
    Show capacity usage without encoding.

Examples:
    stegasoo encode photo.png -r ref.jpg -m "Secret" --passphrase --pin
    stegasoo encode photo.png -r ref.jpg -f doc.pdf -o encoded.png

  decode
Decode a message or file from an image.

stegasoo decode image -r reference [options]

-r, --reference PATH
    Reference photo (shared secret). Required.

--passphrase   TEXT
    Passphrase. Prompts if not provided.

--pin   TEXT
    PIN code. Prompts if not provided.

-o, --output PATH
    Output path for file payloads.

Examples:
    stegasoo decode encoded.png -r ref.jpg --passphrase --pin
    stegasoo decode encoded.png -r ref.jpg -o ./extracted/

  generate
Generate random credentials (passphrase + PIN + optional channel key).

stegasoo generate [options]

--words   INTEGER
    Number of words in passphrase (default: 4).

--pin-length   INTEGER
    PIN length (default: 6).

--channel-key
    Also generate a 256-bit channel key.

Examples:
    stegasoo generate
    stegasoo generate --words 6 --pin-length 8
    stegasoo generate --channel-key

  info
Show version, features, and system information.

stegasoo info [--full]

--full
    Show full system information (CPU, temperature, disk on Pi).

  batch
Batch operations on multiple images.

stegasoo batch subcommand [args]

batch encode
    Encode message into multiple images.

    stegasoo batch encode images... [-m message | -f file] [options]

    Options: -m, -f, -o/--output-dir, --suffix, --passphrase, --pin, -r/--recursive, -j/--jobs, -v/--verbose.

batch decode
    Decode messages from multiple images.

    stegasoo batch decode images... [options]

    Options: -o/--output-dir, --passphrase, --pin, -r/--recursive, -j/--jobs, -v/--verbose.

batch check
    Check capacity of multiple images.

    stegasoo batch check images... [-r/--recursive]

  channel
Manage channel keys for deployment isolation.

Channel keys bind encode/decode operations to a specific group or deployment. Messages encoded with one channel key can only be decoded by systems with the same channel key.

stegasoo channel subcommand [args]

channel generate
    Generate a new random channel key.

    Options: --save (project config), --save-user (user config).

channel show
    Show the current channel key.

    Options: --key TEXT (show specific key instead).

channel qr
    Display channel key as QR code.

    Options: --key TEXT, --format [ascii|png], -o/--output PATH.

channel status
    Show channel key status and configuration.

channel clear
    Remove channel key configuration.

    Options: --project, --user.

  admin
Web UI administration commands.

stegasoo admin subcommand [args]

admin generate-key
    Generate a new recovery key (for reference only).

    Options: --qr (show QR code in terminal).

admin recover
    Reset admin password using recovery key.

    Options: --db PATH (path to stegasoo.db), --password TEXT.

  tools
Image security tools.

stegasoo tools subcommand [args]

tools capacity
    Show steganography capacity for an image.

    stegasoo tools capacity image [--json]

tools exif
    View or edit EXIF metadata.

    stegasoo tools exif image [--clear] [--set FIELD=VALUE] [-o PATH] [--json]

tools peek
    Check if image contains Stegasoo hidden data.

    stegasoo tools peek image [--json]

tools strip
    Strip EXIF/metadata from an image.

    stegasoo tools strip image [-o PATH] [--format [png|bmp]]

ENVIRONMENT

STEGASOO_CHANNEL_KEY
    Channel key for encode/decode operations. Overrides config file settings.

STEGASOO_HTTPS_ENABLED
    Enable HTTPS for web UI (Docker/service mode).

STEGASOO_HOSTNAME
    Hostname for SSL certificate generation.

FILES

~/.stegasoo/channel.key
    User's channel key configuration (encrypted).

.stegasoo.toml
    Project-level configuration file.

frontends/web/instance/stegasoo.db
    Web UI SQLite database (accounts, settings).

EXAMPLES

  Basic encode/decode workflow
# Generate credentials
stegasoo generate
# Encode a secret message
stegasoo encode vacation.png -r selfie.jpg -m "Meet at noon"
# Decode the message (on another system with same reference photo)
stegasoo decode vacation_steg.png -r selfie.jpg

  Using channel keys for team isolation
# Generate and save a channel key
stegasoo channel generate --save-user
# Share the key with your team
stegasoo channel qr -o team-key.png
# Now all encode/decode operations use this channel
stegasoo encode photo.png -r ref.jpg -m "Team secret"

  Batch processing
# Check capacity of all PNGs in a directory
stegasoo batch check ./photos/*.png
# Encode same message into multiple images
stegasoo batch encode ./photos/ -r ref.jpg -m "Secret" -o ./encoded/

SECURITY
Stegasoo uses multiple layers of security:

•   Reference photo provides a visual shared secret

•   Passphrase (recommend 4+ words) for strong encryption

•   PIN code adds additional entropy

•   Channel keys isolate different deployments

•   AES-256 encryption for payload data

For maximum security, share the reference photo out-of-band (in person, secure messenger) and use a strong passphrase.

SEE ALSO
openssl(1), qrencode(1)

BUGS
Report bugs at: https://github.com/adlee-was-taken/stegasoo/issues

AUTHOR
Written by the Stegasoo contributors.

COPYRIGHT
Copyright © 2024-2026. MIT License.