d didof / tools
EXPERIMENT 01 · LOSSLESS
001

STEGANOGRAPHY IN THE BROWSER

A website
inside an image.

Choose a photograph and an HTML file. The lab turns the website into bits, hides them in the pixel colors and generates a new image that looks identical.

INPUT

Prepare the container

Upload an imagePNG, JPEG or WebP as the source
Upload the websiteOne self-contained .html file
Space required—
Image capacityupload an image
OUTPUT

The difference you cannot see

RGB
ORIGINAL
01001000
01010100
01001101
01001100
WITH THE WEBSITE

The result will always be a PNG file: lossless compression keeps every hidden bit intact.

03

What is really
happening?

1

HTML → bits

The file becomes a sequence of zeros and ones. First, we add its size, filename and a checksum to verify it.

2

bits → pixels

Each bit replaces the last binary digit of a red, green or blue channel. The value changes by no more than one.

3

pixels → HTML

The decoder follows the same channels, reassembles the bytes and checks that the result is identical to the original.

This experiment demonstrates the ideal case: intact pixels.

Next experiment: what survives compression?

How to use Website Inside an Image

  1. Choose the carrier image

    Upload a browser-readable image or use the generated sample. The tool shows its resolution and calculates how many payload bytes its red, green, and blue channels can hold.

  2. Choose the website

    Upload one self-contained HTML file or use the interactive sample. Check the scaled preview and confirm that the complete packet fits inside the selected image.

  3. Hide and download

    Encode the packet, wait for the internal byte-for-byte round trip, then download the generated PNG. Keep this lossless file unchanged.

  4. Extract and verify

    Open the Extract tab, load the generated PNG, and recover the website. The preview and HTML download become available only when the stored and calculated CRC-32 values match.

Formats, compatibility, and limits

Inputs

  • One PNG, JPEG, or WebP image that the browser can decode.
  • One self-contained UTF-8 HTML file, including any required CSS and JavaScript.

Outputs

  • A lossless RGBA PNG containing the payload in its least significant RGB bits.
  • The original HTML filename and content after a successful integrity check.
  • An interactive sandboxed preview of the uploaded or recovered website.

Compatibility

  • The encoder accepts common browser-readable images but always exports PNG so every hidden bit remains stable.
  • The decoder reads the generated PNG structure directly and supports non-interlaced 8-bit grayscale, RGB, grayscale-alpha, and RGBA data.
  • The scaled website viewer uses a virtual 1024 × 720 viewport so desktop layouts remain visible on narrow screens.

Known limits

  • JPEG conversion, resizing, cropping, filters, screenshots, and most social-media image pipelines can destroy the hidden payload.
  • The HTML file must be self-contained; external resources are not downloaded or embedded automatically.
  • Usable capacity is approximately three bits per pixel minus the 24-byte header and UTF-8 filename.
  • Large source images require enough device memory to hold decoded RGBA pixels and are limited to 32 million pixels.
  • This first experiment detects corruption but does not add redundancy or error-correcting codes.

Privacy and processing

  • Images and HTML files remain on the current device and are not uploaded by the tool.
  • Encoding, direct PNG parsing, checksum validation, and previews run entirely in the browser.
  • Temporary object URLs are revoked when their files are replaced or the component is closed.

How a website becomes part of the pixels

The encoder converts the UTF-8 filename and HTML into a versioned packet with a fixed signature, payload length, and CRC-32 checksum. It writes the packet one bit at a time into the least significant bit of each red, green, and blue channel, leaving alpha unchanged. The output is constructed as a non-interlaced 8-bit RGBA PNG with explicit IHDR, compressed IDAT, and IEND chunks. The decoder inflates and reverses the PNG scanline filters directly, which avoids the color-management rounding that can flip least significant bits when pixel values pass through a rendering engine. It then rebuilds the packet, checks its declared size, decodes UTF-8, and exposes the HTML only when the calculated CRC-32 matches the stored value.

Questions about Website Inside an Image

Can someone see that the image contains a website?

The changed color values are normally invisible to the eye, but this simple sequential least-significant-bit method is not designed to resist statistical steganalysis.

Why must the result be a PNG?

The decoder depends on exact color values. PNG preserves them losslessly, while JPEG replaces pixel values during compression and usually destroys the stored bits.

Does extracted JavaScript run?

Yes, after a successful checksum. The preview uses a sandboxed iframe that permits scripts, forms, and modals but does not grant the extracted page access to the parent application.

Is CRC-32 encryption?

No. CRC-32 detects accidental changes in the recovered bytes. It does not hide the payload contents, authenticate the sender, or prevent deliberate modification.