Hiding a note and locking a note are two different jobs. This tool does the hiding, and seals the note first — but its seal is a teaching-grade construction (see below). For real secrecy, seal with modern reviewed cryptography first (the Dead Drop, gadget #2), then hide that sealed blob here.
What this tool does
steg.py takes a PNG photo, a passphrase, and a short note — or a file you have already sealed elsewhere, such as a Dead Drop blob — seals the payload, and writes a second PNG that looks like the first. The note is written into the least-significant bit of each colour channel: the smallest possible nudge to each pixel, far below what an eye can pick out. Anyone opening the picture sees a picture. Extracting with the right passphrase recovers the note exactly; the wrong passphrase, or a picture altered after hiding, fails a built-in integrity check and recovers nothing — never a garbled guess presented as success.
Use it — exact commands, in a terminal, in this folder
1 · Hide a text note in a photo (use a copy of the photo, never your only original):
python3 steg.py hide my-photo.png my-photo-hidden.png --passphrase "your passphrase here" --text "The garden gate code rotates on Sunday."
2 · Hide a pre-sealed blob instead — for example a file produced by the Dead Drop:
python3 steg.py hide my-photo.png my-photo-hidden.png --passphrase "your passphrase here" --file dead-drop-sealed.txt
3 · Extract the note back (prints the note; add
--out recovered.txt to save the payload bytes to a file instead — use
--out for blob payloads):
python3 steg.py extract my-photo-hidden.png --passphrase "your passphrase here"
Success prints the exact note and confirms the integrity tag verified.
A wrong passphrase prints a plain refusal —
FAIL: verification failed … — and shows no text at all.
4 · Full help (the honesty sentence above is printed on the help screen too):
python3 steg.py --help
STEG_PASSPHRASE environment variable, which keeps it out of your
shell history.How the seal works — plainly, including its limits
The built-in seal is a documented, teaching-grade construction made only from Python's standard library, so the whole chain can be read in one file: the passphrase is stretched with PBKDF2-HMAC-SHA256 (200,000 rounds, a fresh random salt every seal) into two keys; the note is combined with an HMAC-SHA256 keystream; and an HMAC integrity tag over the whole sealed blob is checked before anything is unsealed. That tag is why a wrong passphrase fails cleanly instead of producing nonsense.
It is not a reviewed modern cipher, and this page will not call it one. The house rule for real secrecy is modern cryptography — the Dead Drop's WebCrypto construction (PBKDF2-SHA256 + AES-GCM-256) is this program's own pointer. The intended strong pattern is exactly that pairing: seal with the Dead Drop, then hide the sealed blob with this tool. That is what “hides existence / protects content” means in practice.
The microdot — the original hide
Long before a note could hide inside a photo file, it hid inside a photograph itself, shrunk to the size of a full stop. A microdot is a page of text or a document photographed down to a dot roughly a millimetre across — small enough to sit on top of a typed period, under a postage stamp, or inside an ordinary-looking letter, and to travel through the post as nothing at all.
The technique grew out of interwar microphotography and was used by intelligence services during the Second World War and the Cold War. Making one took real optics: the document was photographed at extreme reduction through precision lenses onto fine-grain film, and the resulting dot was cut out and placed by hand. Reading one took the opposite instrument — a microscope — and a reader who knew to look. The trade on both sides was the same trade this page is about: the secret was protected less by a lock than by nobody suspecting there was anything to look for. Investigators of the era treated the microdot as a landmark of the craft precisely because a whole page could ride, unseen, in plain sight.
The digital version on this page is the same idea at file scale: reduce
the note until it is a rounding error in something ordinary, and let the
ordinary thing carry it. The microscope is now a command —
steg.py extract — and, just as then, it only finds anything for
someone who already knows a dot is there and holds the key.
Hollow-object craft note — ordinary household hiding places
The physical cousin of this tool is the hollow object: an unremarkable household item with a quiet inside. Two classic, lawful, entirely mundane builds:
A hollow book. Start with a hardback you own and no longer read — thick, ordinary, and destined for a shelf where it will blend in. Wrap the covers and the first few pages in plastic to keep them clean, then brush diluted white glue along the outer edges of the remaining page block and let it dry under weight, so the pages become one solid block. Mark a rectangle inset about 2 cm from the block's edges, and cut straight down through the block a few pages at a time with a sharp craft knife and a metal ruler, lifting out the cut layers as you go, until the cavity is deep enough. Brush glue inside the cavity walls and let it dry fully before anything goes in. It is a rainy-afternoon craft project: the result keeps small keepsakes — a spare key, folded papers, a memory card — out of casual sight on an ordinary shelf.
A false-bottom drawer. Measure the inside of a drawer and cut a panel of thin plywood or stiff card to sit neatly inside it, a few centimetres above the real bottom, resting on four small wood strips glued at the corners. Finish the panel to roughly match the drawer so it reads as the bottom at a glance, and leave one corner very slightly proud so a fingertip can lift it. Flat, light things live underneath — documents, a spare set of photos. Keep the weight on top modest and the contents flat, so the drawer still opens and closes exactly as it always did.
Limits, printed on the face
· PNG carriers only — JPEG re-saving destroys LSB data, and the tool refuses JPEG rather than pretend otherwise.
· The built-in seal is demo-grade (above); seal serious content with modern crypto first, then hide the blob.
· LSB hiding can be suspected by statistical analysis; “hidden” means “not obvious”, never “undetectable”.
· A forgotten passphrase is unrecoverable — there is no back door, by design.
· Everything runs locally on this machine; this page makes no network calls and loads no external assets.