Skip to content
Chethan Yadav
Work

Security/2025/Active

StegoSphere

Open-source LSB steganography for encrypted hidden messages.

Python
Repository

Overview

StegoSphere is a PyQt6 desktop application for LSB (least-significant-bit) image steganography: it hides an encrypted text message inside the pixel data of an image, so the image looks unchanged to the eye but carries a password-protected payload. Everything runs locally — the message, the image, and the encryption happen on your machine, with the only outbound connection being an optional SMTP send if you choose to email the resulting image.

It's built for anyone who wants a self-contained, inspectable way to conceal short text inside ordinary image files, recoverable only with the correct password, without depending on a third-party web tool to do the encoding.

Key Features

  • LSB image steganography — embeds an encrypted payload into the red channel of PNG, JPG, JPEG, or BMP images
  • Password-based encryption — the message is encrypted (via the cryptography library) with a password-derived key before it's embedded, so the image alone isn't enough to recover the text
  • Built-in email delivery — optionally sends the resulting steganographic image to a recipient over SMTP directly from the Encrypt tab
  • PyQt6 desktop UI — separate Encrypt and Decrypt tabs for a straightforward local workflow

Installation

git clone https://github.com/chethanyadav456/StegoSphere.git
cd StegoSphere
 
python -m venv venv
source venv/bin/activate      # Windows: venv\Scripts\Activate.ps1
 
pip install -r requirements.txt

Requires Python 3.8+.

To enable the email-delivery workflow, copy the example env file and set SMTP credentials:

cp env.example .env
[email protected]
STEGOSPHERE_SENDER_PASSWORD=app-specific-password
STEGOSPHERE_SMTP_SERVER=smtp.gmail.com   # optional, this is the default
STEGOSPHERE_SMTP_PORT=465                # optional, this is the default

Then launch the app:

python main.py

Usage

Encrypt a message — open the Encrypt tab, upload an image, enter the text to hide, set a password, optionally enter a recipient email address, then click Encrypt & Send Email.

Decrypt a message — open the Decrypt tab, upload the steganographed image, enter the same password used during encryption, then click Extract Text.

How It Works

  1. You type the message you want to hide.
  2. StegoSphere derives an encryption key from your password and encrypts the message with it.
  3. The encrypted payload is embedded bit-by-bit into the red channel of the chosen image using LSB encoding.
  4. The resulting image is saved locally, and optionally sent by email through the configured SMTP account.
  5. On decrypt, the app reads the LSB payload back out of the image and decrypts it with the same password.

Because encryption happens before embedding, having the image alone isn't enough to recover the message — the password is required too. The project's own security notes are explicit that this is concealment, not a substitute for real operational security: don't commit .env files or real credentials, use app-specific SMTP passwords, and prefer a dedicated sender account for the email flow rather than a personal inbox.

View on GitHub ↗