StegCrypt

StegCrypt is a Flask-based web application for hiding and extracting secret messages inside PNG images. It combines authenticated encryption, payload compression, and pseudo-random LSB steganography in a modular Python architecture.

Overview

StegCrypt is designed as a portfolio-ready security project with a clear separation between Flask routes, application services, cryptography, steganography, validation, and presentation.

Key Features

• AES-256-GCM authenticated encryption
• PBKDF2-HMAC-SHA256 key derivation with random salt
• zlib compression before encryption
• Pseudo-random LSB embedding based on key-derived seed
• PNG RGB/RGBA validation with capacity checks
• Bootstrap 5 UI with drag and drop upload, preview, password strength meter, dark mode, copy actions, and toast notifications
• Automated pytest coverage for crypto and steganography flows

Architecture

flowchart TD
    A[Flask Route] --> B[Service Layer]
    B --> C[Validators]
    B --> D[Crypto Module]
    B --> E[Steganography Module]
    B --> F[Filesystem]
    C --> G[PNG Validation]
    D --> H[AES-256-GCM + PBKDF2]
    E --> I[Pseudo-random LSB]

Loading

Encryption Flow

flowchart TD
    A[Plaintext] --> B[zlib Compress]
    B --> C[PBKDF2 Key Derivation]
    C --> D[AES-256-GCM Encrypt]
    D --> E[Versioned Payload + Salt + Nonce]
    E --> F[Base64 Encode]
    F --> G[Embed into PNG with pseudo-random LSB]

Loading

Decryption Flow

flowchart TD
    A[Stego PNG] --> B[Extract Base64 Payload]
    B --> C[Parse Versioned Header]
    C --> D[PBKDF2 Key Derivation]
    D --> E[AES-256-GCM Decrypt]
    E --> F[zlib Decompress]
    F --> G[Plaintext]

Loading

Project Structure

stegcrypt/
├── app.py
├── config.py
├── crypto/
├── services/
├── steganography/
├── validators/
├── static/
├── templates/
├── tests/
├── requirements.txt
└── README.md

Security Features

• No hardcoded secret key in source code
• No hardcoded IV or nonce values
• AES-256-GCM for confidentiality and integrity
• 96-bit random nonce generated per encryption
• Random salt for every key derivation
• Versioned payload format with magic headers
• PNG-only upload validation
• Image format and mode validation
• Upload size limits
• User-safe error messages without stack traces
• Legacy AES-CBC payload compatibility for older images

Limitations

• JPEG is intentionally not supported for embedding because it is lossy.
• Very small images may not have enough capacity for larger payloads.
• Pseudo-random LSB improves obfuscation, but it is still not equivalent to full cryptographic secrecy.
• Copy actions and theme toggling depend on browser clipboard support and JavaScript.

Future Improvements

• Add PSNR and MSE quality metrics for stego output
• Export metadata JSON for encoded payloads
• Add password generator and salt viewer
• Add embedding and extraction timing metrics in the UI
• Add route-level CSRF protection and stronger request throttling
• Add a proper download token flow for generated images
• Split the app into an application factory pattern for multi-environment deployment

Installation

Prerequisites

• Python 3.10+
• pip

Setup

git clone https://github.com/gbennnn/stegcrypt.git
cd stegcrypt
pip install -r requirements.txt

Run

python app.py

The app runs locally at http://127.0.0.1:5000/.

Usage

Encrypt

1. Open the Encrypt page.
2. Upload a PNG image.
3. Enter your secret message.
4. Enter a password.
5. Download the encoded image after processing.

Decrypt

1. Open the Decrypt page.
2. Upload a StegCrypt-encoded PNG image.
3. Enter the same password.
4. View or copy the decrypted message.

Testing

Run the automated test suite with:

python -m pytest tests -q

The current suite covers:

• Key derivation
• AES encryption and decryption
• Compression and decompression behavior
• Legacy payload compatibility
• Steganography embed and extract round-trips
• Capacity limits
• Invalid image handling
• Wrong password and corrupted payload cases

Technologies Used

• Python
• Flask
• cryptography
• Pillow
• pytest
• Bootstrap 5

Notes

This project is intended for educational and legitimate privacy use only. Do not use it to conceal illegal content or evade security controls.