About Underlayer

Steganography is the practice of concealing information inside another medium so that the presence of the hidden data is not obvious. Unlike encryption alone—which makes content unreadable but still visible as ciphertext—steganography aims to hide the existence of the secret itself.

Common carriers include images, audio, and video. Underlayer focuses on image carriers using least-significant-bit (LSB) techniques.

Underlayer lets you embed one or more payloads (text, files, or audio) into a carrier image and later extract them. Multiple payloads are stored in a single versioned container; embedding order is preserved. Encoding and decoding are designed to run in your browser so carrier images and secrets need not be uploaded to a server.

Tagline: Hide Data in Plain Sight.

Each pixel color channel (red, green, blue) is stored as an 8-bit value. Changing the least significant bit alters the channel by at most 1/255—usually imperceptible. Underlayer writes structured binary data into those LSBs across RGB channels while leaving alpha unmodified when possible.

A versioned binary container (magic, flags, metadata, payload bytes, integrity hash) is embedded so the decoder can find and validate payloads reliably.

Carriers

• PNG — primary carrier and always the output format
• BMP — supported when the browser can decode it
• TIFF — when practical / browser-supported
• JPEG — not supported as a carrier; compression destroys LSB data

Payloads

• Arbitrary text (UTF-8)
• Any normal file as raw bytes (PDF, ZIP, Office documents, binaries, etc.)
• Audio (MP3, WAV, M4A, OGG, FLAC, and similar) treated as binary, with optional in-browser preview and duration when the format is supported

Empty files are rejected. Each file payload is capped at 25 MB in the browser. MIME types are taken from the browser when available, otherwise guessed from magic bytes or extension. Dropped audio files are classified automatically.

• Files are processed locally in your browser whenever possible.
• The server primarily serves the application; it does not need your payloads to encode or decode.
• No third-party analytics or tracking scripts are included.
• Optional encryption (AES-GCM + PBKDF2, 210,000 iterations) protects payload contents; steganography alone only hides them. The password is never stored.

LSB steganography is not magic. Embedded data may be destroyed if the stego image is:

• JPEG compressed
• Resized or cropped aggressively
• Re-encoded by social networks or CDNs
• Heavily edited or run through aggressive optimizers

Always keep the output as PNG when you need the payload to survive. Steganography hides existence; encryption protects contents—Underlayer is designed to support both.