+ New in v3.0 + Stegasoo now supports two embedding modes, each optimized for different use cases. +
+ ++ LSB (Least Significant Bit) embeds data in the lowest bit + of each color channel. Changing the LSB changes pixel values by at most 1, + which is imperceptible to the human eye. +
++ DCT (Discrete Cosine Transform) embeds data in frequency + coefficients rather than raw pixels. This survives JPEG recompression + because coefficients are preserved during re-encoding. +
+| Aspect | +LSB Mode | +DCT Mode | +
|---|---|---|
| Capacity (1080p) | +~770 KB | +~50 KB | +
| Survives JPEG | +❌ No | +✅ Yes | +
| Social Media | +❌ Broken | +✅ Works | +
| Detection Resistance | +Moderate | +Better | +
| Dependencies | +Pillow, NumPy | ++ scipy, jpegio | +
- Uses LSB (Least Significant Bit) embedding with pseudo-random pixel selection. + LSB Mode: Uses Least Significant Bit embedding with pseudo-random pixel selection. The pixel locations are determined by a key derived from your credentials, making the hidden data's location unpredictable without the correct inputs.
++ DCT Mode: Uses Discrete Cosine Transform embedding with Quantization Index Modulation (QIM). + Data is hidden in mid-frequency coefficients of 8×8 blocks, making it resilient to JPEG recompression. + {% if has_dct %} + DCT Available + {% else %} + DCT Requires scipy + {% endif %} +
- New in v2.1 - Stegasoo now supports embedding any file type, not just text messages. + Stegasoo supports embedding any file type, not just text messages.
FastAPI - Stegasoo includes a complete REST API built with FastAPI, featuring automatic documentation, - type validation, and comprehensive error handling. + Stegasoo includes a complete REST API with automatic documentation and type validation.
-POST /generate – Generate credentialsPOST /encode – Encode text message (JSON)POST /encode/file – Encode binary file (JSON)POST /encode/multipart – Encode with file uploadsPOST /encode – Encode text (JSON)POST /encode/multipart – Encode with uploadsPOST /decode – Decode message (JSON)POST /decode/multipart – Decode with uploadsPOST /decode/multipart – Decode with file uploadsPOST /extract-key-from-qr – Extract RSA key from QRPOST /image/info – Get image capacityPOST /extract-key-from-qr – Extract RSA from QRGET / – API status and capabilitiesGET /docs – Swagger documentationGET /redoc – ReDoc documentation/encode/multipart endpoint returns the PNG image directly
- (with headers indicating metadata), while /decode/multipart returns JSON.
- Use --output flag to save responses to files.
- // Generate credentials
-curl -X POST "http://localhost:8000/generate" \
- -H "Content-Type: application/json" \
- -d '{"use_pin": true, "use_rsa": false, "pin_length": 6, "words_per_phrase": 3}'
-
-// Encode text message (images must be base64 encoded first)
-// First encode images: base64 -w0 photo.jpg > photo.b64
-curl -X POST "http://localhost:8000/encode" \
- -H "Content-Type: application/json" \
- -d '{
- "message": "secret message",
- "reference_photo_base64": "'"$(cat photo.b64)"'",
- "carrier_image_base64": "'"$(cat carrier.b64)"'",
- "day_phrase": "apple forest thunder",
- "pin": "123456"
- }'
-
-// Encode file (base64) - encode file first: base64 -w0 document.pdf > doc.b64
-curl -X POST "http://localhost:8000/encode/file" \
- -H "Content-Type: application/json" \
- -d '{
- "file_data_base64": "'"$(cat doc.b64)"'",
- "filename": "document.pdf",
- "reference_photo_base64": "'"$(cat photo.b64)"'",
- "carrier_image_base64": "'"$(cat carrier.b64)"'",
- "day_phrase": "apple forest thunder",
- "pin": "123456"
- }'# Encode text with file uploads
+ Example: DCT Encode
+ # Encode with DCT mode for social media
curl -X POST "http://localhost:8000/encode/multipart" \
-F "day_phrase=apple forest thunder" \
-F "pin=123456" \
+ -F "embedding_mode=dct" \
+ -F "output_format=jpeg" \
-F "reference_photo=@photo.jpg" \
- -F "carrier=@carrier.png" \
- -F "message=secret" \
- --output stego.png
-
-# Encode file (no message field when using payload_file)
-curl -X POST "http://localhost:8000/encode/multipart" \
- -F "day_phrase=apple forest thunder" \
- -F "pin=123456" \
- -F "reference_photo=@photo.jpg" \
- -F "carrier=@carrier.png" \
- -F "payload_file=@document.pdf" \
- --output stego.png
-
-# Encode with RSA key from QR code (optional)
-curl -X POST "http://localhost:8000/encode/multipart" \
- -F "day_phrase=apple forest thunder" \
- -F "pin=123456" \
- -F "reference_photo=@photo.jpg" \
- -F "carrier=@carrier.png" \
- -F "message=secret" \
- -F "rsa_key_qr=@keyqr.png" \
- --output stego.png
-
-# Decode with file uploads (returns JSON)
-curl -X POST "http://localhost:8000/decode/multipart" \
- -F "day_phrase=apple forest thunder" \
- -F "pin=123456" \
- -F "reference_photo=@photo.jpg" \
- -F "stego_image=@stego.png" \
- --output result.json
+ -F "carrier=@meme.png" \
+ -F "message=secret message" \
+ --output stego.jpg
- The API can extract RSA keys from QR code images. QR code reading requires
- pyzbar and libzbar system library.
-
# Extract key from QR code (returns JSON)
-curl -X POST "http://localhost:8000/extract-key-from-qr" \
- -F "qr_image=@keyqr.png"/docs for Swagger UI or /redoc for ReDoc documentation.
- All endpoints include detailed schemas and example requests.
-
- Stegasoo also includes a full-featured CLI. Install with pip install stegasoo[cli]
- or see the CLI documentation for complete usage.
-
# CLI Examples
+ Command Line
+ # Generate credentials
stegasoo generate --pin --words 3
+
+# Encode with LSB (default)
stegasoo encode -r photo.jpg -c meme.png -p "phrase" --pin 123456 -m "secret"
-stegasoo decode -r photo.jpg -s stego.png -p "phrase" --pin 123456
-stegasoo info image.png
+
+# Encode with DCT for social media
+stegasoo encode -r photo.jpg -c meme.png -p "phrase" --pin 123456 -m "secret" \
+ --mode dct --format jpeg
+
+# Decode (auto-detects mode)
+stegasoo decode -r photo.jpg -s stego.png -p "phrase" --pin 123456- {% if has_argon2 %}Argon2 Available{% else %}PBKDF2 Fallback{% endif %} + {% if has_argon2 %}Argon2{% else %}PBKDF2{% endif %} + + + {% if has_dct %}DCT Available{% else %}DCT Unavailable{% endif %} - {% if has_qrcode_read %}QR Reading Available{% else %}QR Reading Not Available{% endif %} + {% if has_qrcode_read %}QR Reading{% else %}No QR Reading{% endif %}
abc123_20251228.png).
- Use this to determine which day's phrase to use!
+ abc123_20251231.png).
| Max text message | -2 million characters (~2 MB) | +2 million characters |
| Max file payload | @@ -422,6 +486,14 @@ stegasoo info image.pngMax carrier image | 24 megapixels (~6000×4000) |
| LSB capacity | +~375 KB/megapixel | +|
| DCT capacity | +~75 KB/megapixel | +|
| Max upload size | 30 MB | @@ -440,15 +512,7 @@ stegasoo info image.png|
| Phrase length | -3-12 words (BIP-39 wordlist) | -|
| API documentation | -/docs (Swagger) and /redoc | -|
| QR code support | -RSA key encoding/extraction (up to 3072 bit keys) | +3-12 words (BIP-39) |
Stegasoo v{{ version }} • Open Source • - Built with Python, FastAPI, and cryptography + Built with Python, Flask/FastAPI, and cryptography
diff --git a/frontends/web/templates/index.html b/frontends/web/templates/index.html index b958c92..bc73181 100644 --- a/frontends/web/templates/index.html +++ b/frontends/web/templates/index.html @@ -25,9 +25,9 @@- Hide and enrypt secret data in an image like a photo or meme. + Hide encrypted messages or files inside images
- Extract and decrypt data from Stegasoo-encoded images + Extract and decrypt hidden data from stego images
- Create weekly phrase card with PIN and/or RSA key. + Create weekly phrase cards, PINs, and RSA keys