Steganographic

Hidden in a photo

The message is concealed inside an ordinary photograph and sent through any platform.

Taftan AES-256 encrypts a short message and conceals it inside a normal-looking JPEG or PNG photograph. The photo can be shared on any platform (WhatsApp, Telegram, Signal, X, email, AirDrop) and only someone with the passphrase can recover the hidden text. Two distinct modes are exposed: Normal (the photo is kept byte-for-byte intact at the pixel level and the encrypted payload is appended into the file structure) and Robust (the JPEG cover is modulated so that the payload survives heavy recompression by social platforms). Encryption is identical in both modes; the choice is about transport, not about secrecy.

Methods

Normal (file or document share)

Pixels are not touched. The encrypted envelope is appended into the file structure of the image. PNG covers: payload appended to the last IDAT chunk before IEND, marked with 0xDEADBEEF. JPEG covers: payload written into a 0xFFFE COM (comment) segment immediately after SOI, marked with 'MRGD'. The image renders identically and the COM segment is inert (cameras and editors write COM segments routinely, so its presence does not flag the image). Capacity is tens of kilobytes, practical limit set by the COM segment for JPEG and IDAT for PNG. Use this when the platform preserves the file bytes: WhatsApp and Telegram "send as document", X.com PNG posts within the size limit, email, Drive, AirDrop, USB.

+ Zero visual change. Tens of kilobytes of capacity.- Does not survive any platform that re-encodes the image (default photo send on WhatsApp / Telegram / Instagram, image-resize CDNs).

Robust (photo share through chat platforms)

Block-luminance modulation of the JPEG cover with Hamming(7,4) error-correcting code and threefold redundancy. The output is always JPEG even if the cover was a PNG. Verified to survive JPEG re-encoding down to quality 70: WhatsApp default photo send, Telegram default photo send, Instagram DM. Capacity is 500 to 2000 characters depending on the cover dimensions. The cost is a very faint pattern that is only visible on close inspection.

+ Survives social-media recompression at JPEG quality 70.- Lower capacity. A faint pattern is visible if the photo is examined closely.

Strong points

Travels wherever the photo can travel. The photo goes through the internet; the hidden message rides inside the file. Hide and Reveal both run locally on the device. Nothing calls home.
Two modes for two transports: Normal for sharing the image as a file or document (pixels untouched, no visual change, tens of kilobytes of capacity), and Robust for sharing the image as a photo through platforms that recompress (500 to 2000 characters of capacity).
AES-256-GCM with PBKDF2-SHA256 at 100,000 iterations protects the payload in both modes. The same passphrase is required to reveal.

Trade-offs

Both people need Taftan installed and must share the same passphrase.
Cover image must be between 4 KB and 6 MB. Capacity depends on the cover photo and the mode. Not a file transport for arbitrary binaries, text only.

Get started

Two devices. One shared password. No intermediary.

Install Taftan on both devices, agree on the password through a separate channel beforehand, and run a quick test transfer using whichever channel fits your situation.

Download the application Read the documentation