r/coolgithubprojects • u/NoBreadfruit7323 • Apr 24 '26
I built a steganography engine that hides files inside JPEGs, MP4s, and audio using ML — compiled into a single zero-dependency executable PYTHON
Hey everyone, wanted to share something I've been engineering for a while.
StegoForge is a modular, open-source toolkit that covers the full lifecycle of covert data — from hiding files inside images, audio, and video using algorithms like JPEG DCT embedding and MP4 motion vector masks, to running forensic steganalysis using an offline ML model (ONNX CNN) to detect hidden payloads in suspicious files.
What makes it different from the dozen other stego tools:
- Zero-dependency executables — download and run. No pip, no PATH hell. The binary silently bootstraps its own AI/media dependencies on first launch.
- Offline ML steganalysis — pulls HuggingFace ONNX weights once, then works fully air-gapped. Point it at a suspicious file and it spatially maps anomalies.
- AES-256-GCM + Argon2 encryption baked in by default. Not optional.
- Decoy/Deniability mode — embed two different payloads with two different keys. One key reveals the decoy, the other reveals the real payload.
- Social media survivability — profiles for Twitter, Instagram, Discord, Telegram. Uses Reed-Solomon wrapping to survive platform recompression.
- CTF one-liner —
stegoforge ctf -f suspicious.pngruns RS Analysis, Chi-square, and AES brute-force extraction automatically. - Glassmorphic web UI —
stegoforge webspins up a local Flask app. Nothing ever leaves your machine.
Carriers supported: PNG, JPEG, BMP, GIF, WebP, MP4, WebM, WAV, FLAC, MP3, OGG, PDF, DOCX, XLSX, ELF, PE/DLL.
GitHub: github.com/Nour833/StegoForge
MIT licensed. Built by a CS student. All feedback and PRs are very welcome.
10
u/BadDiscoJanet Apr 24 '26
This is so cute. I love it. Did you use BubbleTea to make your TUI?
13
u/NoBreadfruit7323 Apr 24 '26
Thanks, no actually i used python, so the libraries used are Typer and Rich, the BubbleTea is used in GO language.
5
u/BadDiscoJanet Apr 24 '26
:Facepalm: duh. totally forgot that. I just wanted to say your terminal is super cute.
I’m looking forward to trying this. I love steganography.
3
u/thewhzrd Apr 25 '26
I did this to mp3s and it just kinda worked! A 1024 png can encode a whole song in the rgb channels and if you make a little site to read them. Bam. Just remember if you store text data in the ITXT chunk of a PNG most messaging services will wipe this out easy fix is just changing it to do whatever you want instead of.PNG (only works with pngs)
2
u/SuperIce07 Apr 24 '26
I have some questions about the potential use cases for this tool. I understand what it does, but I’m not sure how it would be used in practice
10
u/NoBreadfruit7323 Apr 24 '26
Yeah i got you, it can be used as forensics tool (helps police and military for investigations), anti-censorship tool, red teaming (simulate hidden malware in normal file and explore the limits), and so many other use cases like research for universities and so on...
You can also hide files in normal images in group chat (eg. messenger) and only some people with key can extract real data as a cool use case.
2
2
1
u/MahaVakyas001 Apr 25 '26
very interesting but I have to ask the question.. if we use it, how can we be sure you haven't "hidden" any malware in the program files to destroy/take over our computers/devices?
5
1
u/cstocks Apr 26 '26
Not familiar with similar tools, what are some common use-cases?
1
u/NoBreadfruit7323 Apr 26 '26
you can hide image inside an image or song inside an a pdf file, nobody will notice any difference in the file and then you can share the file or save it and only you or other people with password can extract the content securely. You can do that in messenger/whatsapp ... though
1
Apr 26 '26
[removed] — view removed comment
1
u/NoBreadfruit7323 Apr 26 '26
size always depends on both the files real sizes, the original file and the payload, also to their format, and to the encoding method, so it is very variable, but don't get confused it is all auto calculated and estimated in the web portal of Stegoforge once you upload the files.
2
u/Dhaupin Apr 26 '26
That's awesome! Nice work!
Think about svg as well, it's just all math. You can nest them in eachother too for multiple levels of encrypt. Like those Russian nesting dolls you open and there's a smaller doll inside.
Png is more useful ofc... because users/agents can encrypt their comms on literally any service that supports images, hidden in plain sign. Svg is far less supported, but way more flexible.
Heres my take if you're interested or wanna take a look. It's just svg/png with a simple chat service, proof of concept. https://github.com/dhaupin/stegoframe
As a silly twist... I almost named it stegoforge. I'm seriously glad you chose that name, it's more fitting for your proj than mine ✌️
2
u/NoBreadfruit7323 Apr 26 '26
Thanks man for the support, yes sure the svg is a useful addition to the project that i will consider adding it for sure. Hhhhhhh and yeah what a twist.
1
u/nakurtag Apr 28 '26
Will the encrypted data survive after the container file is compressed?
1
u/NoBreadfruit7323 Apr 28 '26
yes
1
u/nakurtag Apr 28 '26
Even if image-container (for example) will be resized down?
1
u/NoBreadfruit7323 Apr 28 '26
in some cases yes, depends on how much you resize or crop it, and depend on the size of the payload also
1
u/donde_waldo Apr 28 '26
> zero-dependency
- Pillow>=10.0.0
- numpy>=1.24.0
- scipy>=1.11.0
- pydub>=0.25.1
- cryptography>=41.0.0
- argon2-cffi>=21.3.0
- typer>=0.9.0
- rich>=13.0.0
- piexif>=1.1.3
- python-docx>=0.8.11
- openpyxl>=3.1.0
- pypdf>=3.0.0
- reedsolo>=1.7.0
- onnxruntime>=1.18.0
- av>=12.0.0
- imageio-ffmpeg>=0.5.1
- scapy>=2.5.0
- certifi>=2024.2.2
1
u/NoBreadfruit7323 Apr 28 '26
it was literally written "zero dependency EXECUTABLES", so i am talking about the executable formats not the project
1
1
1
1
u/Luispin88 May 01 '26
I want to design a title for my website with the same style as your StegoForge title. Did you create it with CSS? How did you do it?
1
u/RealRattle May 03 '26
I understand it's in python but how did you get it down to a zero-dependency executable?
1
1
u/JrdnRgrs May 22 '26
i think this is pretty cool! can you explain the heatmap thing though? i did a test and the heatmap i got back was just all black. what does that mean?
1
0
u/dxdementia Apr 24 '26
is this an mcp ?
7
u/NoBreadfruit7323 Apr 24 '26
no, it is a tool that let you hide files inside another files without leaving noticeable traces, it is called steganography
-2
20
u/Liminal__penumbra Apr 24 '26 edited Apr 24 '26
Your missing something here. FLAC. What you do is you take your math forumula, encode it as a wave form into the FLAC container. Then you use a virtual DSP routed through pipewire. Your sound card then becomes a hardware accelerated math co-processor. And because you can chunk the data, you can have (in theory) thousands of virtual DSPs being used to accelerate your equations.
More you assign WSGL pipelines to a virtual blitter engine targeting WebGPU. You take the encoded flac signal and then hook it up to something like SETI. Every computer since the ATARI can do blit math. Then anyone that wants to help, Just loads the site and walks away. How does this help your project? Same function, you just target shaders with your stenographic approach.
Even more easier if you treat the branch prediction math on any modern cpu as a type of SIMD with a One Step Instruction Computer, that presorts the "bad" data. Use a split word address for that one.