SHH(28)

NAME
shh - hide files inside PNG images using steganography

SYNOPSIS
shh hide image.png secret output
shh decode input output

DESCRIPTION
shh is a steganography tool that hides files inside PNG images. Data is appended after the PNG IEND chunk, making the image appear normal while containing hidden content.

When hiding with a password, data is encrypted using AES-256-CBC with PBKDF2 key derivation (100,000 iterations).

COMMANDS

hide
    Hide a file inside a PNG image. Creates two output files: output.png (the stego image) and output.txt (base64 encoded version for safe upload). Password is optional (press Enter to skip).

decode
    Extract hidden file from a stego image. Accepts both PNG and base64 encoded TXT as input. Auto-detects format.

EXAMPLES
Hide a file without password:

    $ shh hide photo.png secret.html output
    Password: [Enter]

Hide a file with password:

    $ shh hide photo.png secret.pdf output
    Password: ********
    Confirm: ********

Extract from PNG:

    $ shh decode output.png extracted
    $ file extracted
    extracted: HTML document, ASCII text
    $ mv extracted extracted.html

Extract from base64:

    $ shh decode output.txt extracted
    Password: ********
    $ file extracted
    extracted: PDF document, version 1.4
    $ mv extracted extracted.pdf

SECURITY

Encryption
    AES-256-CBC with random salt and IV

Key Derivation
    PBKDF2-HMAC-SHA256 with 100,000 iterations

Password
    Not echoed to terminal

FILES

output.png
    Stego image (valid PNG with hidden data)

output.txt
    Base64 encoded stego image (for upload to services that re-encode images)

EXIT STATUS

0   Success

1   Error (wrong password, file not found, etc.)

NOTES
The hidden data is appended after the PNG IEND chunk. Image viewers only read up to IEND, so the image displays normally.

Some services (Facebook, Twitter, etc.) re-encode uploaded images, which removes hidden data. Use the base64 TXT output for text-based sharing, or upload to services that preserve original files.

AUTHOR
Written by P.A.O

SEE ALSO
openssl(1), steghide(1), binwalk(1)