StegText - Hide Secret Messages In Plain Sight
An app for hiding secret messages inside ordinary-looking text using Unicode zero-width character steganography, with optional ChaCha20-Poly1305 encryption.
How It Works
StegText lets you embed a secret message into a cover text. The secret is converted to binary and mapped to invisible Unicode zero-width characters, which are inserted into the cover text. The result looks like normal text but carries hidden data that can only be revealed with the correct password.
For instance:
This text looks completely normal.
However, if you copy the above line and paste it into a character counter, you will see that it is 412 characters. With a completely secure and encrypted message. With a good password, it is impossible to break. Great for sending secret messages over social media!
Features
Steganography: Secret data is hidden inside Unicode zero-width characters (U+200C, U+200D, U+2060, U+2061, U+2062, U+2063) embedded in a cover text.
ChaCha20-Poly1305 Encryption: When a password is provided, the secret message is encrypted with authenticated encryption using PBKDF2 key derivation (100,000 iterations, SHA-256).
LZW Compression: When no password is used, the secret message is compressed with LZW before being hidden.
In-Memory Only: No data is sent to any server. All encoding and decoding happens locally in the app.
How to Use
Encoding (Hiding a Message)
1. Open the program.
2. Click "GET STARTED" on the intro screen.
3. Click "ENCODE".
4. Enter your secret message.
5. Optionally enter a password (recommended).
6. Enter a cover text (at least 2 words; longer is better).
7. Click "ENCODE & HIDE".
8. Copy the resulting text. It looks normal but contains the hidden message.
Decoding (Revealing a Message)
1. From the home screen, click "DECODE".
2. Paste the encoded text.
3. Enter the password (if one was used during encoding).
4. Click "DECODE & REVEAL".
5. The secret message is displayed.
Technical Details
Cipher: ChaCha20-Poly1305 (authenticated encryption).
Key Derivation: PBKDF2 with SHA-256, 100,000 iterations, 16-byte random salt.
Nonce: 12 random bytes per encryption.
Payload Format: When encrypted, the payload is E:base64(salt || nonce || ciphertext || tag). When compressed only, it is C:base64(LZW data).
Embedding: The payload string is prefixed with 0000, converted to binary, split into 2-bit pairs, and each pair is mapped to one of four zero-width characters. These characters are appended to a randomly chosen word in the cover text.
Extraction: All zero-width characters are collected, mapped back to binary, reassembled into bytes, and decoded.
Requirements
No requirements.
Limitations
The cover text must contain at least 2 words.
Longer secret messages require longer cover texts for reasonable concealment.
Some messaging platforms may strip or normalize zero-width characters, which would destroy the hidden message.
The security of the encryption depends entirely on the strength of the password chosen.
Credits
Version 1.0. In memory of Matthew Bromley.
Purchase
In order to download this tool you must purchase it at or above the minimum price of £5 GBP. You will get access to the following files:
Leave a comment
Log in with itch.io to leave a comment.