ENCODE☰

DECODE

What is this?

Hides/reveals secret messages in text. Optimized for instant messaging.

Messages are encoded as zero-width Unicode characters, as a casual form of steganography.

Install the Chrome extension to automatically parse web pages for secret messages.

Usage

Tab / Shift+Tab — cycle through fields

Drag and drop files onto page to encode.

Possible uses

What can be hidden:

• Text
• URLs (similar use to QR codes)
• Watermarks
• Small files

Possible places for storage:

• Chat messages
• Social media posts
• User profile information
• Forums
• HT⁢⁢‌‌⁠⁣⁠︁⁡⁢‌‍⁠⁤⁣⁢⁤⁤⁤︁⁤⁠‌⁤⁣⁠⁠⁤⁣⁠‌‌⁠⁤⁣⁢⁢⁠‌⁤⁡⁤⁤⁣⁤⁤⁣⁠⁠⁠‌⁤⁢⁤⁤︁⁠⁢⁠‌⁤⁣⁡ML
• Emails
• Digital documents
• File names (very short messages only)

How does it work?

Unicode contains some zero-width, unprintable characters. We use 16 of them to encode any data in hexadecimal, using our arbitrary encoding scheme.

The resulting string of invisible characters is then inserted at a random location in the cover text.

Efficiency

Each invisible character represents 4 bits, while taking 3 bytes (24 bits) to store. Thus, the hidden data consumes 6 times as much memory as the original data, not including header data and cover text.

Comparison to other steganography techniques

Pros

• Produces no visible alteration in the text.
• Can theoretically store a near-unlimited amount of data regardless of length of the cover text.
• Can be used with applications that do not support file transfers.
• Reduces suspicion by not requiring the frequent transfer of large files during communication.

Cons

• Can be filtered or corrupted by applications that do not support Unicode, or that attempt to format user input.
• Extremely easy to detect. Any digital text can be checked for the possible presence of a message by pasting it into a decoder, or a text editor that displays non-printing characters. Large messages may create line breaks in some applications.

If you are serious about concealing your payload, you should use another form of steganography.

As with any method of communication, security is only as good as the encryption applied. This only provides a casual level of security through obscurity.