Stegasoo is a secure steganography tool that hides encrypted messages and files inside ordinary images using multi-factor authentication.
New in v3.0 Stegasoo now supports two embedding modes, each optimized for different use cases.
LSB (Least Significant Bit) embeds data in the lowest bit of each color channel. Changing the LSB changes pixel values by at most 1, which is imperceptible to the human eye.
DCT (Discrete Cosine Transform) embeds data in frequency coefficients rather than raw pixels. This survives JPEG recompression because coefficients are preserved during re-encoding.
| Aspect | LSB Mode | DCT Mode |
|---|---|---|
| Capacity (1080p) | ~770 KB | ~50 KB |
| Survives JPEG | ❌ No | ✅ Yes |
| Social Media | ❌ Broken | ✅ Works |
| Detection Resistance | Moderate | Better |
| Dependencies | Pillow, NumPy | + scipy, jpegio |
Stegasoo uses hybrid multi-factor authentication to derive encryption keys:
{% if has_argon2 %}
Argon2id Available
Using Argon2id with 256MB memory cost — the winner of the Password Hashing Competition
and current best practice for key derivation. This makes GPU/ASIC attacks infeasible.
{% else %}
Argon2 Not Available
Falling back to PBKDF2-SHA512 with 600,000 iterations.
Install argon2-cffi for stronger security.
{% endif %}
LSB Mode: Uses Least Significant Bit embedding with pseudo-random pixel selection. The pixel locations are determined by a key derived from your credentials, making the hidden data's location unpredictable without the correct inputs.
DCT Mode: Uses Discrete Cosine Transform embedding with Quantization Index Modulation (QIM). Data is hidden in mid-frequency coefficients of 8×8 blocks, making it resilient to JPEG recompression. {% if has_dct %} DCT Available {% else %} DCT Requires scipy {% endif %}
Stegasoo supports embedding any file type, not just text messages.
FastAPI Stegasoo includes a complete REST API with automatic documentation and type validation.
POST /generate – Generate credentialsPOST /encode – Encode text (JSON)POST /encode/multipart – Encode with uploadsPOST /decode – Decode message (JSON)POST /decode/multipart – Decode with uploadsPOST /image/info – Get image capacityPOST /extract-key-from-qr – Extract RSA from QRGET / – API status and capabilitiesGET /docs – Swagger documentationGET /redoc – ReDoc documentation# Encode with DCT mode for social media
curl -X POST "http://localhost:8000/encode/multipart" \
-F "passphrase=apple forest thunder mountain" \
-F "pin=123456" \
-F "embed_mode=dct" \
-F "dct_output_format=jpeg" \
-F "reference_photo=@photo.jpg" \
-F "carrier=@meme.png" \
-F "message=secret message" \
--output stego.jpg# Generate credentials
stegasoo generate --pin --words 4
# Encode with LSB (default)
stegasoo encode -r photo.jpg -c meme.png -p "apple forest thunder mountain" \
--pin 123456 -m "secret"
# Encode with DCT for social media
stegasoo encode -r photo.jpg -c meme.png -p "apple forest thunder mountain" \
--pin 123456 -m "secret" --mode dct --dct-format jpeg
# Decode (auto-detects mode)
stegasoo decode -r photo.jpg -s stego.png -p "apple forest thunder mountain" \
--pin 123456{% if has_argon2 %}Argon2{% else %}PBKDF2{% endif %} {% if has_dct %}DCT Available{% else %}DCT Unavailable{% endif %} {% if has_qrcode_read %}QR Reading{% else %}No QR Reading{% endif %}
| Max text message | 2 million characters |
| Max file payload | {{ max_payload_kb }} KB |
| Max carrier image | 24 megapixels (~6000×4000) |
| LSB capacity | ~375 KB/megapixel |
| DCT capacity | ~75 KB/megapixel |
| Max upload size | 30 MB |
| Temp file expiry | 5 minutes |
| PIN length | 6-9 digits |
| RSA key sizes | 2048, 3072, 4096 bits |
| Passphrase length v3.2.0 | 3-12 words (BIP-39, recommended: 4+ words) |
Stegasoo v{{ version }} • Open Source • Built with Python, Flask/FastAPI, and cryptography