🖼️ Hide a File Inside a Photo

Tuck any file, or a typed message, into the pixels of an ordinary photo. It still looks like the photo. Lock it with a passphrase, send the PNG as a file attachment, and whoever receives it opens it on the Reveal tab of this page to get the file back byte for byte. Posting it as a picture to Instagram, Facebook, iMessage or a normal WhatsApp photo send re-saves it as a JPEG and wipes what is inside, so it has to travel as a file. Free, and your photo and your file never leave this tab.

1 Pick the cover photo
🖼️
Drop a photo here
JPG, PNG, WebP, GIF, anything your browser can open. HEIC straight off an iPhone usually needs converting to JPG first.
The result has to be a PNG, and a PNG of a full size phone photo can easily be 20 MB or more. Shrinking the photo makes the file you have to send much smaller, at the cost of how much it can carry. Transparent areas get filled with white, because a see through pixel cannot hold data reliably.
2 Pick what goes inside
A file
A typed message
Drop the file to hide
any type at all, it comes back out unchanged
3 Lock it with a passphrase
With a passphrase your file is encrypted with AES 256 GCM before a single bit goes into the picture, using a key stretched from your words with 250,000 rounds of PBKDF2. Without one, anyone who suspects something is in there can read it straight back out with a tool like this one.
4 Hide it
Bits used per colour channel
Auto
1 bit
2 bits
3 bits
4 bits
Each pixel has a red, a green and a blue value from 0 to 255. We overwrite the lowest bits of each one. One bit changes a value by at most 1, which no eye and no screen can show. Four bits changes it by up to 15, which starts to show as speckle in a clear sky. Auto picks the smallest setting your file actually fits in.
Read this before you start. The photo that comes out only works if it travels as a file: an email attachment, Google Drive, Dropbox, WeTransfer, or the "send as document" option in WhatsApp or Telegram. Posting it as a picture to Instagram, Facebook, iMessage or a normal WhatsApp photo send re-saves it as a JPEG and the hidden file is gone. Whoever receives it opens it on the Reveal tab at the top of this page, no other tool can read this layout.

🎬 Plus PDF signing, video compression, batch watermarking and 250+ more free toolsOpen Castwright

What this actually does to the picture

A photo is a grid of pixels and every pixel is three numbers between 0 and 255, one each for red, green and blue. The bottom bit of each number is worth almost nothing to your eye. Change red from 137 to 136 and no screen on earth shows the difference, but you have just stored one bit. A twelve megapixel photo has thirty six million of those numbers, so at two bits each it can carry about nine megabytes of anything at all. Your file is chopped into bits and written into those lowest positions in order, behind a small header that records the file name, its type, its length and a checksum. Reading it back is the same walk in reverse.

Why the output must be a PNG, and why it is so big

JPEG throws away detail on purpose, and the first detail it throws away is exactly the low bit noise we just wrote. Save the result as a JPEG and the hidden file is destroyed, every time, with no warning. PNG is lossless, so it is the only sensible output. The cost is size. A one megabyte JPEG turns into a fifteen to twenty megabyte PNG, partly because raw pixels do not compress well and partly because the bits we wrote look like random noise to the compressor. That is not a bug in this tool, it is the price of the technique. If the size matters, shrink the photo before you hide anything in it.

How to send it without breaking it

Send the PNG as a file, not as a picture. An email attachment, Google Drive, Dropbox, WeTransfer, or the send as document option in WhatsApp and Telegram all pass the bytes through untouched. Posting it to Instagram, Facebook, iMessage or a normal WhatsApp photo send will re-compress it into a JPEG and the hidden file will not be there any more. Cropping, rotating, resizing, running a filter over it or letting a phone gallery app "optimise" it all have the same effect. Tell the person you send it to where to open it, because the file comes back out on the Reveal tab of this page, at https://castwright.vercel.app/tools/photo-file-vault.html.

Be honest with yourself about what this is

Hiding a file in a photo is concealment, not secrecy. Anyone who suspects something is there can detect that the low bits are not natural, because the scanners that look for that are free and this is the most common technique there is. Pulling the file back out is a separate step: the block is written in this page's own layout, so the Reveal tab here is what reads it, not a general steganography tool. Detection is easy, extraction needs this page, and what actually protects the contents is the passphrase. With one, the file is encrypted with AES 256 GCM before it is written in, so someone who extracts it gets a block of noise they cannot open. Without one, treat this as hiding a key under a plant pot. It is also worth saying plainly that there is no recovery path for a forgotten passphrase, because nothing is stored anywhere for us to reset.

Things people use it for

Sending a password or a recovery phrase to yourself in a way that does not look like a password. Slipping a licence key or a contract inside a picture on a shared drive. Watermarking a photo with proof of who made it, invisibly. Teaching someone how steganography works with a real example rather than a diagram. Puzzle and treasure hunt makers use it constantly. And plenty of people just want to see it work once, which is a good enough reason.