A Windows toolkit for what is really inside an image

What it is

An image file is two things at once: the picture you see, and a large amount of data you do not. StegoPixel exists for the second part. It reads the metadata other tools hide, hides data of its own in pixels and metadata, finds what somebody else hid, and estimates whether a photograph was ever a photograph.

It is one application rather than a collection of command-line utilities because the tasks share a working set. You load an image once, and the metadata inspector, the privacy scanner, the forensic panels and the steganography tools all operate on that same file, with results that stay available to each other. When you need to do the same thing to four hundred files, the workflow builder turns the sequence you just performed by hand into a saved pipeline.

How it is designed

StegoPixel's interface is built on a design system the project calls “Data Clarity First”. It exists because forensic work involves long sessions of scanning subtle visual anomalies, and every unnecessary interface element costs attention that should be spent on the image.

• Zero UI distraction. Panels and borders stay muted so your eyes go to the image. Floating toolbars that overlay the content are banned — controls sit in a docked bar above the canvas, never on top of it.
• Contrast does the work. Critical readouts — hashes, dimensions, tag values — are separated by strong text contrast rather than by colour, so they remain legible in either theme and for colour-blind users.
• The accent means something. The cyan accent is never decorative. It marks an active state, a primary action, or a status that needs attention — nothing else.
• Data is structured, not dumped. Dense metadata becomes labelled cards with an uppercase title above a high-contrast value. Hashes are never wrapped mid-character.
• Discovery surfaces look different from analysis surfaces. Dashboards, empty states and feature cards use a frosted-glass treatment with an icon-forward layout; forensic panels stay solid and quiet, so the two modes are never confused.
• Motion is minimal on purpose. Only a handful of short opacity fades exist in the whole application. Everything else snaps, because animation in a tool you use for hours is noise.

This website is a translation of that same system — the same palette, type scale, corner radii and spacing values, carried over so the product and the page that describes it read as one thing.

Cryptography and algorithms

What protects a hidden payload, and what the forensic checks are built on:

• AES-256-CBC with PBKDF2-HMAC-SHA256 at 100,000 iterations, a 6-byte salt and a 16-byte IV for payload encryption.
• Reed–Solomon RS(255,223) over GF(256) for the optional error-correcting mode, with Berlekamp–Massey, Chien and Forney decoding.
• RSA-2048/4096 and ECDSA P-256/384/521 for image signing, with PKCS#8 and PEM key import.
• SHA-256 and SHA-512 for content digests, plus average, difference and perceptual hashes for similarity.
• PCA via a closed-form trigonometric eigensolver, and a chi-square pairs-of-values LSB test reported with a Wilson–Hilferty p-value.
• Block-hash copy-move detection with union-find clustering of matched regions.

Requirements

StegoPixel is a Windows desktop application. Everything it needs ships inside the package, so there is no separate runtime or framework to install first.

Project status

StegoPixel is in pre-release. It has not been published, and this site will not pretend otherwise.

Editorial principles

How claims get made on this site. It seemed worth writing down.

• No capability is described that the code does not implement. Where a feature is partially wired, the page says so — see the status section above.
• Heuristics are labelled as heuristics. AI verdicts, watermark carrier scans and provenance parsing are described as the statistical methods they are, not as machine learning or as verification.
• No accuracy figures are quoted. There is no labelled benchmark behind them, so quoting a percentage would be inventing one.
• Limits are stated next to capabilities, not buried — the format matrix, the capacity caveat and the re-encoding warning are all on the features page rather than in a footnote.
• Nothing is claimed about licensing that has not been decided. The FAQ says so plainly rather than implying “open source” because it sounds reassuring.

Contact

Support and feedback channels will be published alongside the Microsoft Store listing, since that is where the product will actually live and where the support link belongs. Until then: