--- title: "3 Steps to Hide Data in an Image Using Steganography" description: "Learn a simple 3-step method to hide any data inside a JPEG image using steganography, including how to use tools and validate your hidden data." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "Person", "@id": "https://christianespinosa.com/#person", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "image": "https://christianespinosa.com/__l5e/assets-v1/de07e44b-a8e0-4bcc-bcb0-13aec15421f1/headshot-front.jpg", "sameAs": [ "https://www.facebook.com/christian.espinosa.official", "https://x.com/Ironracer", "https://www.instagram.com/christian.espinosa.official/", "https://www.youtube.com/@ChristianEspinosaOfficial", "https://www.linkedin.com/in/christianespinosa/" ], "jobTitle": "Bestselling Author, Keynote Speaker, Entrepreneur", "worksFor": { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com/" } }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://christianespinosa.com/#website", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "publisher": { "@id": "https://christianespinosa.com/#organization" }, "inLanguage": "en-US" }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://christianespinosa.com/#organization", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "logo": { "@type": "ImageObject", "url": "https://christianespinosa.com/logo.svg" }, "founder": { "@id": "https://christianespinosa.com/#person" }, "sameAs": [ "https://www.facebook.com/christian.espinosa.official", "https://x.com/Ironracer", "https://www.instagram.com/christian.espinosa.official/", "https://www.youtube.com/@ChristianEspinosaOfficial", "https://www.linkedin.com/in/christianespinosa/" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "3 Steps to Hide Data in an Image Using Steganography - Christian Espinosa", "description": "Learn a simple 3-step method to hide any data inside a JPEG image using steganography, including how to use tools and validate your hidden data.", "image": "https://christianespinosa.com/__l5e/assets-v1/c8a724ec-75fa-4162-b874-a236d3abdb88/3-steps-to-hide-data-in-an-image-using-steganography-card.png", "datePublished": "2021-09-04T06:40:47+00:00", "dateModified": "2026-06-26T05:31:25.714Z", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://christianespinosa.com/blog/3-steps-to-hide-data-in-an-image-using-steganography" }, "author": { "@type": "Person", "name": "Christian Espinosa", "url": "https://christianespinosa.com/about" }, "publisher": { "@type": "Organization", "name": "Christian Espinosa", "logo": { "@type": "ImageObject", "url": "https://christianespinosa.com/logo.svg" } } }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is the core idea behind \"3 Steps to Hide Data in an Image Using Steganography - Christian Espinosa\"?", "acceptedAnswer": { "@type": "Answer", "text": "In this post we'll explain a simple method to hide data (any type of data - text, image, malware, etc.) in a JPEG." } }, { "@type": "Question", "name": "Who is this post for?", "acceptedAnswer": { "@type": "Answer", "text": "Honestly, security leaders, medical device teams, and technical operators who want the honest version, not the vendor version. If you want a listicle, this is not that. If you want the honest version of what I have actually lived and worked through, keep reading." } }, { "@type": "Question", "name": "How do I actually apply this, not just nod along?", "acceptedAnswer": { "@type": "Answer", "text": "Pick the single line in the post that made you flinch or look away, and change one thing in your week because of it. One choice this week beats a whole framework you never touch." } } ] } ] --- [Skip to content](#main) [](/) [About](/about)[Speaking](/speaking)[Cybersecurity](/cybersecurity)[Programs](/programs)[Books](/books)[Media](/media) Writing Search Ctrl K[Connect](/connect) [Cybersecurity](/blog/category/cybersecurity) # 3 Steps to Hide Data in an Image Using Steganography September 4, 2021 4 min read 799 words I'm going to show you a simple way to hide any kind of data in a JPEG. It could be text, another image, or even malware. This is steganography, the art of hiding something right in front of everyone. I do this when I don't want anyone to even suspect there's a secret message or hidden data. ![](/__l5e/assets-v1/18c0aa89-574f-45e3-96b4-4234e281a67f/945051984db2.jpg) The takeaways 1. 01 Steganography hides data inside an ordinary-looking image; the payload can be text, another image, or malware. What to do next Send yourself a test image with an embedded string using a free tool and confirm your outbound email gateway lets it through. 2. 02 Tools like JPHS make hiding and extracting data trivial for anyone who can follow three clicks. What to do next Add a five-minute steganography demo to your next security awareness session so the team stops thinking of it as theoretical. 3. 03 Because the carrier image looks unchanged, standard email and web filters usually miss the exfiltration entirely. What to do next Ask your DLP owner this week whether image payload inspection is on, and if the answer is no, put it on the roadmap. 4. 04 Defenders should assume attackers already use this channel and monitor for unusual image traffic accordingly. What to do next Review last month's egress logs and flag any image files over 500 KB leaving the network to non-corporate destinations. This image looks like any other, but I've hidden a file inside. I'm going to show you a simple way to hide any kind of data in a JPEG. It could be text, another image, or even malware. This is [steganography](https://en.wikipedia.org/wiki/Steganography), the art of hiding something right in front of everyone. I do this when I don't want anyone to even suspect there's a secret message or hidden data. I'm skipping the history lesson on steganography. I'll get straight to how I do it. ### 1\. Download and extract the JPHS (JPEG Hide and JPEG Seek) tool: - gwdg.de site ### 2\. Download a cover image (the image you will hide the data inside of) and a hide image (the image you will hide inside the cover image): The cover image should be roughly 10 times the size of the hide image.  In our example, we will use a HD Background as the cover image and a picture of a cute kitten as the hide image. - Cover Image; background.jpg (found doing a Google search for “hd backgrounds”): Source: http://hdgreatimages.com/wp-content/uploads/2016/04/Bridge-HD-Backgrounds.jpg - Hide Image; kitten.jpg (found doing a Google search for “lilbub”): ### 3\. Run Jphswin. Accept the terms. Do the following: Click on “Open jpeg”, select “background.jpg” and click “open”: Selecting the Input (Cover) file in JPHS for Windows Click on “Hide”, enter a passphrase, click “OK”, then select the hide file (kitten.jpg), and click “Open”: Selecting the Hide file in JPHS for Windows Save the steg’d file (the kitten.jpg file hidden in the background.jpg file) as another file name, so we can compare the new file containing the hidden data with the original file. Click “Save jpeg as” and use the file name “bridge.jpg” (or something different than the original name): Saving the Steg’d file in JPHS for Windows You should now see 3 files; the “background.jpg” should look the same (to the naked eye) as the “bridge.jpg” even though the “kitten.jpg” file is hidden inside “bridge.jpg”: Open both “background.jpg” and “bridge.jpg” side-by-side in Windows Photo Viewer to see if you can tell a difference: Original image on the left. Steg’d image on the right. Can you see any difference? Congratulations! You’ve just practiced steganography. ## Validation Let’s validate our steganography demonstration actually worked by extracting the “kitten.jpg” from the “bridge.jpg”: Using JPHS for Windows, select “Open jpeg”, select “bridge.jpg”, click “Open”: Opening the image containing the hidden file in JPHS for Windows After you opened the “bridge.jpg” file click on “Seek”, enter the passphrase you used to hide the file, click “OK”, then save the hidden file as “secret.jpg”: Saving the hidden file as “secret.jpg” in JPHS for Windows Verify the “secret.jpg” file is the same as the “kitten.jpg” file by opening “secret.jpg”. The extracted “secret.jpg” is the same as “kitten.jpg”. Our steganography example worked! To validate which image pixels JPHS for Windows modified to hide the image in the cover image, you can use Beyond Compare to visually depict the differences. Download and install [Beyond Compare](http://www.scootersoftware.com/).  If you receive an “Error creating registry key:” you need to install as an Administrator. Run Beyond Compare. On the left side, select “New”, the double-click “Picture Compare”: Double-click Picture Compare Open the original picture (background.jpg) on the left window in Beyond Compare and open the steg’d picture (bridge.jpg) on the right window.  The comparison should be in the bottom window: One example of where the pixels differ is shown above; the pixel on the left has RGB:47,109,184, on the right it is RGB:47,109,186 ## Resources Files used/referenced in this blog: - JPHS for Windows (This application is included in the jphs\_05.zip) - background.jpg - kitten.jpg - bridge.jpg - secret.jpg Video on this topic: Frequently asked ### What is the core idea behind "3 Steps to Hide Data in an Image Using Steganography - Christian Espinosa"? ### Who is this post for? ### How do I actually apply this, not just nod along? ### Work with me I help founders and cybersecurity leaders build teams that ship, not teams that stall. If that's the problem you're trying to solve, let's talk. [Start a conversation](/contact) Share this essay [X ](https://twitter.com/intent/tweet?url=https%3A%2F%2Fchristianespinosa.com%2Fblog%2F3-steps-to-hide-data-in-an-image-using-steganography&text=3%20Steps%20to%20Hide%20Data%20in%20an%20Image%20Using%20Steganography) [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fchristianespinosa.com%2Fblog%2F3-steps-to-hide-data-in-an-image-using-steganography) [Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fchristianespinosa.com%2Fblog%2F3-steps-to-hide-data-in-an-image-using-steganography) [Email](mailto:?subject=3%20Steps%20to%20Hide%20Data%20in%20an%20Image%20Using%20Steganography&body=https%3A%2F%2Fchristianespinosa.com%2Fblog%2F3-steps-to-hide-data-in-an-image-using-steganography)Copy link ![Christian Espinosa, headshot](/__l5e/assets-v1/de07e44b-a8e0-4bcc-bcb0-13aec15421f1/headshot-front.jpg) About the author [Christian Espinosa](/about) · Founder & CEO, Blue Goat Cyber Christian is the founder and CEO of Blue Goat Cyber, a medical device cybersecurity firm. He's an Air Force Academy graduate, 24x Ironman, climber of two of the Seven Summits, and the author of The Smartest Person in the Room and The In-Between: Life in the Micro. Keep reading - [ ### 2 Simple Ways to Extract GPS Coordinates from Images - Christian Espinosa Same thread: cybersecurity. Read essay → ](/blog/2-simple-ways-to-extract-gps-coordinates-from-images) - [ ### What Is Total Intelligence, and How To Build a Cyber Team to Lead with It - Christian Espinosa Same thread: cybersecurity. Read essay → ](/blog/what-is-total-intelligence-and-how-to-build-a-cyber-team-to-lead-with-it) - [ ### Top 10 Largest Healthcare Data Breaches by Number of Records Stolen - Christian Espinosa Same thread: cybersecurity. Read essay → ](/blog/top-10-largest-healthcare-data-breaches-by-number-of-records-stolen) [← Previous essay 2 Simple Ways to Extract GPS Coordinates from Images - Christian Espinosa ](/blog/2-simple-ways-to-extract-gps-coordinates-from-images)[Next essay → Top 10 Organized Cybercrime Syndicates - Christian Espinosa ](/blog/top-10-organized-cybercrime-syndicates) Related, Cybersecurity ### Need medical-device or offensive security expertise? Blue Goat Cyber, Christian's firm, runs FDA-aligned premarket submissions, penetration testing, and SBOM/SOUP analysis for medtech and high-stakes industries. [Explore Blue Goat Cyber](/cybersecurity) Christian Espinosa Bestselling author, keynote speaker, and Founding CEO of [Blue Goat Cyber](https://bluegoatcyber.com/). Helping technical leaders develop the soft skills that turn brilliance into impact. [](https://www.linkedin.com/in/christianespinosa/)[](https://x.com/Ironracer)[](https://www.instagram.com/christian.espinosa.official/)[](https://www.youtube.com/@ChristianEspinosaOfficial)[](https://www.facebook.com/christian.espinosa.official) Explore - [About](/about) - [Timeline](/timeline) - [Speaking](/speaking) - [Cybersecurity](/cybersecurity) - [Programs](/programs) Read - [Books](/books) - [Guides](/guides) - [Blog](/blog) - [Media](/media) - [Podcast Interviews](/podcasts) - [Success Stories](/success-stories) Connect - [Contact Christian](/connect) - [LinkedIn ↗](https://www.linkedin.com/in/christianespinosa/) - [Blue Goat Cyber ↗](https://bluegoatcyber.com/) - [Resources](/resources) © 2026 Christian Espinosa. All rights reserved. [Privacy](/privacy-policy)[Terms](/terms-of-use)