Image steganography benchmark
Which way of hiding a message in an image actually survives?
Compare 8 methods against 20 attacks and 3 detectors. Runs entirely in your browser.
Client side only. AES-256-GCM payload. Reed-Solomon error correction.
- 8methods compared
- 20attacks applied
- 3detectors run
- 0 bytesuploaded anywhere
Method
From a secret to a ranked leaderboard in five steps
- 1
Choose cover and secret
Pick one image or a whole folder. Type a message or choose a file, then set a passphrase.
- 2
Protect the payload
The secret is encrypted with AES-256-GCM, wrapped with a length and checksum, and given Reed-Solomon error correction.
- 3
Hide it
Each selected method embeds the bits: LSB variants, DCT, spread spectrum, DWT or content-adaptive S-UNIWARD.
- 4
Attack and extract
The stego image is attacked, then the message is read back with the same key and compared with the original.
- 5
Score and rank
Robustness, invisibility, detectability and capacity combine into a ranking you can reweight for your goal.
Attacks
What happens inside one attack test
For every method and every attack, StegoBench repeats the same six steps and records how much of the message survived.
- 1
Take the stego image
The image that already holds the hidden bits, as lossless PNG or saved as JPEG at quality 90.
- 2
Apply the attack
For example a real browser JPEG re-encode at quality 75, a 50% resize, Gaussian noise or a 3-pixel shift.
- 3
Extract with the same key
The method reads the bits back from the attacked image and never sees the original cover.
- 4
Correct errors
Reed-Solomon decoding repairs flipped bytes when error correction is on, equally for every method.
- 5
Compare with the original
Recovery is chance adjusted: a 50% bit match counts as 0%, a perfect match as 100%.
- 6
Add to the scores
All attacks average into the robustness score and fill one cell of the attack heat map.
Results
All 8 methods, measured
12 generated covers of 512×384 pixels, a 60-byte AES-GCM payload, 20 attacks. Reproduce it with npm run validate.
| Method | Domain | PSNR | JPEG QF75 | Gaussian σ5 | Shift 3 px | Detectability |
|---|---|---|---|---|---|---|
| DWT-QIM (Haar) | Transform | 40.1 dB | 100% | 100% | 1% | Medium RS 0.61 |
| DCT + Vote (ECC) | Hybrid | 41.2 dB | 100% | 100% | 4% | Medium WS 0.62 |
| Spread Spectrum | Transform | 38.6 dB | 100% | 100% | 1% | High WS 0.85 |
| DCT (Koch-Zhao) | Transform | 45.9 dB | 100% | 100% | 4% | Medium RS 0.56 |
| LSB Matching (±1) | Spatial | over 80 dB | 2% | 4% | 1% | Low Chi 0.53 |
| Random LSB | Spatial | over 80 dB | 3% | 0% | 1% | Low WS 0.53 |
| Sequential LSB | Spatial | over 80 dB | 3% | 0% | 2% | Medium Chi 0.61 |
| S-UNIWARD + STC | Adaptive | 85.6 dB | 1% | 0% | 3% | Low RS 0.51 |
Frequency-domain methods survive compression but are easier to detect. Spatial methods stay quiet until the image is attacked. The covers are generated images, so use your own photos in the dashboard before drawing conclusions.