Text Steganography Using Whitespace And Zero Width Characters — Complete Documentation & Simulation

Overview & System Context

Text Steganography Using Whitespace And Zero Width Characters: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~9529 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background Steganography ( , STEG-I-NOG-rI-fee) is the practice of representing information within another message or physical object, in such a manner that the presence of the information is not evident to human inspection. Generally, the hidden messages appear to be (or to be part of) something else: images, articles, shopping lists, or some other cover text. The following is a list of techniques used in steganography.

The letter size, spacing, typeface, or other characteristics of a cover text can be manipulated to carry the hidden message. Only a recipient who knows the technique used can recover the message and then decrypt it. Francis Bacon developed Bacon's cipher as such a technique. In the early days of the printing press, it was common to mix different typefaces on a printed page because the printer did not have enough copies of some letters in one typeface. Thus, a message could be hidden by using two or more different typefaces, such as normal or italic. During and after World War II, espionage agents used photographically produced microdots to send information back and forth. Microdots were typically minute (less than the size of the period produced by a typewriter). World War II microdots were embedded in the paper and covered with an adhesive, such as collodion that was reflective and so was detectable by viewing against glancing light. Alternative techniques included inserting microdots into slits cut into the edge of postcards. Printing introduces noise in the ciphertext, at times rendering the message unrecoverable. There are techniques that address this limitation, one notable example being ASCII Art Steganography.

Some types of modern color laser printers integrate the model, serial number, and timestamps on each printout for traceability reasons using a dot-matrix code made of small, yellow dots not recognizable to the naked eye — see printer steganography for details. Hiding a message in the title and context of a shared video or image. Misspelling names or words that are popular in the media in a given week, to suggest an alternate meaning. Hiding a picture that can be traced by using Paint or any other drawing tool.

Figure 1: IIIIIII 10 II: IIIIIIII 10 IIIIIIIIIII, IIIIIII (invisible zero-width ... Concealing messages within the lowest bits of noisy images or sound files. A survey and evaluation of relevant literature/techniques on the topic of digital image steganography can be found here. Concealing data within encrypted data or within random data. The message to conceal is encrypted, then used to overwrite part of a much larger block of encrypted data or a block of random data (an unbreakable cipher like the one-time pad generates ciphertexts that look perfectly random without the private key). Chaffing and winnowing. Mimic functions convert one file to have the statistical profile of another. This can thwart statistical methods that help brute-force attacks identify the right solution in a ciphertext-only attack. Concealed messages in tampered executable files, exploiting redundancy in the targeted instruction set. Pictures embedded in video material (optionally played at a slower or faster speed). Injecting imperceptible delays to packets sent over the network from the keyboard. Delays in keypresses in some applications (telnet or remote desktop software) can mean a delay in packets, and the delays in the packets can be used to encode data. Changing the order of elements in a set. Content-Aware Steganography hides information in the semantics a human user assigns to a datagram. These systems offer security against a nonhuman adversary/warden. Blog-Steganography. Messages are fractionalized and the (encrypted) pieces are added as comments of orphaned web-logs (or pin boards on social network platforms). In this case, the selection of blogs is the symmetric key that sender and recipient are using; the carrier of the hidden message is the whole blogosphere. Modifying the echo of a sound file (Echo Steganography). Steganography for audio signals. Image bit-plane complexity segmentation steganography Including data in ignored sections of a file, such as after the logical end of the carrier file. Adaptive steganography: Skin tone based steganography using a secret embedding angle. Embedding data within the control-flow diagram of a program subjected to control flow analysis The text or multimedia output of some generative artificial intelligence programs, such as ChatGPT, can be altered to include steganographic data that is impossible to detect, even in theory, when compared with the natural output of the program.

In 2003, Giannoula et al. developed a data hiding technique leading to compressed forms of source video signals on a frame-by-frame basis. In 2005, Dittmann et al. studied steganography and watermarking of multimedia contents such as VoIP. In 2008, Yongfeng Huang and Shanyu Tang presented a novel approach to information hiding in low bit-rate VoIP speech stream, and their published work on steganography is the first-ever effort to improve the codebook partition by using Graph theory along with Quantization Index Modulation in low bit-rate streaming media. In 2011 and 2012, Yongfeng Huang and Shanyu Tang devised new steganographic algorithms that use codec parameters as cover object to realise real-time covert In 1977, Kent concisely described the potential for covert channel signaling in general network communication protocols, even if the traffic is encrypted (in a footnote) in "Encryption-Based Protection for Interactive User/Computer Communication," Proceedings of the Fifth Data Communications Symposium, September 1977. In 1987, Girling first studied covert channels on a local area network (LAN), identified and realised three obvious covert channels (two storage channels and one timing Engineering, vol. SE-13 of 2, in February 1987. In 1989, Wolf implemented covert channels in LAN protocols, e.g. using the reserved fields, pad fields, and undefined fields in the TCP/IP protocol. In 1997, Rowland used the IP identification field, the TCP initial sequence number and acknowledge sequence number fields in TCP/IP headers to build covert channels. In 2002, Kamran Ahsan made an excellent summary of research on network steganography. In 2005, Steven J. Murdoch and Stephen Lewis contributed a chapter entitled "Embedding Covert Channels into TCP/IP" in the "Information Hiding" book published by Springer. Steganophony – the concealment of messages in Voice-over-IP conversations, e.g. the employment of delayed or corrupted packets that would normally be ignored by the receiver (this method is called LACK – Lost Audio Packets Steganography), or, alternatively, hiding information in unused header fields. WLAN Steganography – transmission of steganograms in Wireless Local Area Networks. A practical example of WLAN Steganography is the HICCUPS system (Hidden Communication System for Corrupted Networks) Several schemes hide arbitrary data in ordinary-looking text by encoding bits as invisible characters. Each leaves a recognizable fingerprint: StegCloak uses the invisible math operators U+2061–U+2064 in one contiguous run, base-N schemes use fixed-width digits from a small alphabet, and variation selectors offer 240 symbols per position. Whitespace schemes hide bits in trailing spaces and tabs, where no code point is unusual and only the pattern gives it away.

Figure 2: CTF misc 0IIIIII_unicode steganography with zero-width characters (-CSDNII StegCloak encodes two bits per character over a six-symbol alphabet: U+200C, U+200D and the four invisible math operators U+2061 through U+2064. The payload is compressed, optionally encrypted with AES-256-CTR, and inserted as a single unbroken run immediately before a randomly chosen word in the first half of the cover text.

The fingerprint is the alphabet. U+2061–U+2064 exist for MathML and appear almost nowhere else, so their presence in prose is close to conclusive. The first character of the run is a header flag identifying whether the payload is encrypted and whether it carries an HMAC, which lets a detector report the mode rather than just the presence. A more general family treats a set of N invisible characters as digits in base N and encodes each character of the payload as a fixed-width group. With the common four-character alphabet — U+200C, U+200D, U+202C, U+FEFF — each UTF-16 unit takes eight carrier characters.

Unlike StegCloak these are often scattered through the cover text rather than kept contiguous, which makes run-length detection less useful. They are, however, brute-forceable: try the plausible alphabets and orderings, decode, and check whether the result reads as text. Figure 3: GitHub - timcoding112/Zero-Width-Encrypt: A simple gui program that ...

Unicode defines 256 variation selectors — 16 in U+FE00–U+FE0F and 240 more in U+E0100–U+E01EF. Each can follow a base character without producing a glyph of its own, which makes the supplement a wide channel: one byte per selector, appended to a single visible character. The legitimate uses are narrow — emoji presentation and CJK glyph variants — so a selector following a Latin letter has no defensible explanation.

Not every scheme uses exotic code points. Tools in the SNOW lineage encode bits in trailing spaces and tabs at the end of each line, where every character involved is entirely ordinary. No code-point blocklist can catch this. Detection has to look at the pattern: how many lines carry trailing whitespace, how long those runs are, and whether tabs appear in them. Editors leave the occasional stray space; they do not produce multi-character space-and-tab sequences on line after line.

Detection that brute-forces decodings will happily produce a plausible-looking "hidden message" from characters that were never a payload. Persian prose is full of legitimate zero-width non-joiners; a BOM-prefixed CSV starts with U+FEFF; MathML uses the invisible operators for their intended purpose. The guard is to be strict about what counts as a recovered message — no lone surrogates, no unassigned-heavy output, and a result that actually reads like words. Telling someone their text contains a secret when it does not is a worse failure than missing a real one.

Every category of invisible, zero-width and blank-rendering Unicode character, what each one is legitimately for, and when its presence is a signal that something is hidden in your text. SynthID-Text and Anthropic's Claude watermark are statistical, living in the model's word choices rather than in any added character. Stripping invisible characters has no effect on them whatsoever.

How the U+E0000 block hides instructions that people cannot see but language models read, why it works, and how to strip it before untrusted text reaches a model. Detect and decode data hidden in whitespace characters - spaces, tabs, and zero-width characters. Whitespace steganography hides data in the invisible characters of text files: trailing spaces, tab/space encoding, or zero-width Unicode characters. The text looks identical to the human eye, but the invisible bytes encode a hidden message.

Understand and create polyglot files - valid in two formats simultaneously - used in CTF steganography. Find and decode data hidden in Unicode homoglyphs, variation selectors, and lookalike characters. Some Unicode characters render with zero width — they exist in the string but take no visible space. We use two of them as binary digits: U+200B (zero-width space) means 0, U+200C (zero-width non-joiner) means 1. Insert enough of them into ordinary text and you can hide any message without changing how the text looks.

You will sometimes see a third character, U+200D (zero-width joiner) mentioned. We deliberately do not use it — two characters are enough for binary and the decoder stays simpler. U+200D in cover text is ignored on decode, not stripped. Hide the 1-byte secret 'A' (0x41) in "hello" with password "pw" . We'll do every step by hand. encrypt_message(b"A", "pw") produces Fernet ciphertext. Fernet adds a random IV, so the real output is unpredictable; for this walkthrough pretend the ciphertext comes out to exactly one byte: In real use Fernet's output is much longer (version byte + timestamp + IV + ciphertext + HMAC tag). The math is identical — just more bits. We use 1 byte so the page fits.

Each 0 → U+200B , each 1 → U+200C . That's 40 invisible characters. The encoder inserts the whole block right after the first character of "hello" : The invisible characters above are real — if your browser rendered this page, the underlined span contains the actual payload. To the eye the line still reads hello . Copy-paste it, open it in any text editor, and it still reads hello . But a tool that counts zero-width chars will find 40.

Scan the whole text. For each character, check: is it U+200B ? Append 0 . Is it U+200C ? Append 1 . Otherwise skip. We get the 40-bit string back: First 32 bits → 1 (length). Next 8 bits → 0x41 ( b"A" ). Hand bytes + password to Fernet → original secret. 2. System Architecture & Core Working Principles Skip the paper and use the demo or CLI: echo "hello" | python steg.py encode -m zw -p pw -s "A" -o stego.txt then python steg.py decode -m zw -p pw -i stego.txt .

Sanitizing platforms. WhatsApp, Discord, Telegram in some modes, GitLab rendered Markdown, and most rich-text email clients strip U+200B / U+200C on paste or render. The payload is silently deleted. Test your channel before trusting it. Encoding round-trips. If text gets re-encoded through a system that drops "format" or "invisible" Unicode categories (some legacy pipelines, ASCII-only transports), the characters vanish. Any byte lost means the length header no longer matches and decode returns b"" .

The cluster is detectable. This tool inserts all the invisible chars as one block right after the first character. A steganalyst scanning the byte offsets of U+200B / U+200C sees a giant spike at position 1 — proof of a payload and a hint it's this tool. Distributing the chars evenly across the cover would help; the code marks this as a known simplification. See zw_encode in steg.py .

Cover validators occasionally reject zero-width chars. Some forms (passwords, usernames, payment fields) treat zero-width chars as suspicious and reject the whole string. Don't try to hide a payload inside a username. Lossy visual transport. Screenshots, OCR, text-to-speech, and printed paper all drop the invisible chars. The payload only survives digital copy-paste that preserves Unicode.

Against the secret's contents : yes, it is encrypted. Fernet is AES-128-CBC + HMAC-SHA256. The key is SHA-256(password). Even given the stego text and the password, the attacker still needs the password to decrypt. Wrong password → HMAC mismatch → Fernet throws InvalidToken , nothing leaks. Against the key: no. Key derivation is plain SHA-256 — no salt, no PBKDF2. An attacker with the ciphertext can brute-force a weak password offline at full hash speed. Marked as a known simplification in the README; upgrade to PBKDF2HMAC + random salt if offline brute-force is part of the threat model.

No — and worse than the whitespace method here. U+200B and U+200C essentially never appear in normal prose. Any count above zero is positive evidence of a payload. python steg.py detect -m zw -i text.txt counts the invisible chars, divides by 8 for the hidden byte count, and reads the 4-byte length header to say exactly how many bytes are hidden — all without the password. Steganography hides content from humans, not from analysis tools.

Pick zero-width when the channel preserves Unicode and strips trailing whitespace — rendered text in most chat apps, web pages, raw paste boxes. Pick whitespace when the opposite is true (raw files, source code, plain-text email). They fail in opposite conditions, which is why this tool ships both. Plain text looks like the last place to hide data, which is exactly why it works. The payload lives in characters you cannot see — trailing whitespace, zero-width code points, or letters that look identical but are not. The tell is almost always a byte count larger than the visible text , or text that "copies wrong".

Data is encoded in trailing spaces and tabs at the end of lines — invisible in most editors. Zero-width space (U+200B), non-joiner (U+200C) and joiner (U+200D) render as nothing but carry bits. Two zero-width characters → binary → bytes. The same "invisible character" idea has several modern variants. Run the code-point dump above first, then match the ranges you find: Different Unicode code points can look identical — Latin a (U+0061) versus Cyrillic I (U+0430). Mixing them encodes data or watermarks the text. An Irongeek homoglyph decoder recovers the message.

When you clean up suspicious text, keep a copy of the original — Unicode normalization destroys exactly the code points that carry the payload. Recovered a blob that is not yet a flag? The Encodings & obfuscation page is the full recognition-and-decoding reference (bases, XOR, classical ciphers, Morse, Braille, QR); the essentials for text blobs: Instead of modifying pixels or sound waves, data is concealed using spaces, tabs, or invisible Unicode characters.

stegsnow hides or extracts data using trailing whitespace at the end of lines or within text blocks. Command recipes for plain-text and Unicode challenges. The tell is almost always a byte count larger than the visible text , or text that "copies wrong". Depth on the Text & Unicode technique page ; for the payload you recover, see the encodings cheatsheet .

Zero-width space (U+200B), non-joiner (U+200C), joiner (U+200D) render as nothing but carry bits. python3 -c "import unicodedata;print(unicodedata.normalize('NFKC',open('f.txt').read()))" collapses homoglyphs/compatibility forms — diff against the original to see exactly which characters were swapped. I Try the live demo on GitHub Pages - Encode and decode messages directly in your browser! Ever wanted to send a message that looks like normal text but actually contains hidden data? Well, now you can! This project implements whitespace steganography across 7 different programming languages - because why choose one when you can have them all? whitespace-stego encodes messages using invisible Unicode control characters that are completely undetectable when viewing text normally. Your secret message is hidden right there in the whitespace - but you'd never know it! The result? Text that looks identical to normal text, but contains your hidden message! I All implementations are fully cross-compatible - encode with Python, decode with Rust, mix and match however you want! After running make build-cli-all , all CLI binaries are available in the bin/ directory: Note: The Python binary requires PyInstaller to be installed. If it's not available, the build will skip it but other binaries will still be built.

Cross-language compatibility is tested to ensure any message encoded by one language can be decoded by any other: See requirements.sdoc for the full specification. The algorithm is language-agnostic and follows RFC 4648 Base64 encoding. Remember: This is for fun and learning. Don't use this for actual security-critical applications. The invisible characters can be detected if someone knows what to look for! A steganography toolkit that hides messages using invisible Unicode whitespace characters (like zero-width space, non-breaking space, etc.) within text. Includes Python and Rust implementations, a pluggable CLI, and support for encoding, decoding, and detection.

A byte is 8 bits. Each bit is either 0 or 1. A line of text can quietly carry one bit by ending in an ordinary space (means 0) or a tab character (means 1). Stack enough lines and you can hide any message as invisible trailing whitespace — no strange characters, no colors, nothing the eye notices. 3. Software Implementation, Frameworks & Protocols Let's hide the 1-byte secret 'A' (= 0x41) in this 3-line cover using password "pw" . We'll do every step by hand so you can see the bits.

encrypt_message(b"A", "pw") asks Fernet for ciphertext. Fernet adds a random IV, so the real bytes are unpredictable; for this walkthrough pretend the ciphertext comes out to exactly one byte: In real use Fernet's output is much longer (it prepends a version byte, timestamp, IV, and appends an HMAC). The math is identical — just more bits. We use 1 byte here so the page fits.

The length of the ciphertext is 1. Encode 1 as a 4-byte big-endian integer, then concatenate the ciphertext: Cover is 3 lines, payload is 40 bits → we need 40 lines, so the encoder pads with 37 empty lines. Bit 0 → space, bit 1 → tab. The first few lines become: Notice the giveaway: the cover had 3 short lines, but the stego text now has 40 lines, most of them empty. That is the single biggest detection signal for this method and you cannot avoid it — see §6.

For each line, read backwards: tab=1, space=0, stop at non-whitespace. You get the same 40-bit string back: First 32 bits → int(...,2) = 1 , so the decoder knows to read 1 more byte. The next 8 bits → 01000001 = 0x41 = b"A" . Hand b"\x41" and "pw" to Fernet → original secret. You can skip the paper and just use the demo or the CLI: echo "cover" | python steg.py encode -m ws -p pw -s "A" -o stego.txt then python steg.py decode -m ws -p pw -i stego.txt .

Whitespace stripping. Most Markdown renderers, code formatters (Prettier, Black with --trim-trailing-whitespace ), git diff with -w , and many chat apps delete trailing whitespace on save or render. If even one trailing space/tab is removed, the bit string shifts and decode fails (returns b"" ). Line reflow. Re-wrapping text (word processors, Gmail compose) joins and splits lines. The bit-per-line assumption breaks.

The payload is gone. Line-count blowup. Each payload bit eats one line. A 1 KB ciphertext needs (4 + 1024) × 8 = 8224 lines. A short cover gets padded with thousands of empty lines — instantly suspicious. Existing tabs in the cover. A \t already inside a line would be misread as a 1-bit by the decoder (it walks backwards from the end and tabs are tabs from either side). The encoder refuses covers that contain any tab. Same for pre-existing trailing whitespace — the encoder rejects it to avoid ambiguity.

HTML / rich text. Web pages collapse runs of whitespace and ignore trailing whitespace entirely. Pasting rendered HTML destroys the payload. Only transport as plain text. Yes, against the secret's contents : it is encrypted. Fernet is AES-128-CBC with HMAC-SHA256 authentication. The key is SHA-256(password). Even with the stego text and the password, the attacker still needs the password to decrypt. Wrong password → HMAC mismatch → Fernet throws InvalidToken , nothing leaks.

No, against the key. Key derivation is plain SHA-256 — no salt, no PBKDF2. An attacker who has the ciphertext can brute-force a weak password offline at full hash speed. The README marks this as a known simplification; if your threat model includes offline brute force, switch to PBKDF2HMAC with a random salt (and ship the salt — it can be public). No. Steganography hides content from humans, not from analysis. python steg.py detect -m ws -i text.txt counts trailing tabs; many lines ending in tabs is positive proof a payload exists. The detect command even reads the 4-byte length header and tells the attacker exactly how many bytes are hidden , no password required. The password protects the contents , not the existence .

Pick whitespace when the channel preserves trailing whitespace but strips zero-width characters — e.g. raw text files, plain-text email, source-code comments, git diff without -w . For everything else (HTML, chat apps, rendered Markdown) the zero-width method usually survives better. ZW Steg is a python command-line tool implemented to hide secret messages through zero-width Unicode characters. This tool was inspired by Steganographr , 330k and the TryHackMe Room The Impossible Challenge .

The idea of zero-width character stenography is converting a private message into binary data. Then the binary characters space, zero and one are mapped to three different zero-width characters. This will be appended to a public message. The result is that only the public message will be visible. This method is relatively hard to detect because most text editors display these Unicode characters with zero width - as it’s supposed to. However, there are add-ons for different browsers that transform these characters into emojis (Exp. ZeroWidth Detection by Mikkel D. ).

Now that we understand what the tool does, we can take a look at how I coded the tool. You can check out the GitHub repository to get the full code. First, I collected a list of zero-width characters. I mainly used the list from 330k for this. Next, I created the encoding function. This is the function that takes the secret and public message and hides the secret in the public message through these zero-width characters.

For the encoding, I needed a way to map the binary characters to the zero-width characters. I decided to create two lists and map the positions. This could have also been done with dictionaries. The first step is to transform the secret message into binary. In Python, the ord() function transforms a character into an ASCII value/integer. The integer can then be transformed into binary with format(x, 'b') . Each binary representation of a character will be joined with a space.

Finally, we have a binary string that only contains spaces, zeros and ones. These characters can then be mapped to the zero-width characters. bin_list.index(b) returns the position of the current character. The equivalent position in the char_list is the zero-width character that represents the character from the binary string. The zero-width characters are appended to the end of the public message. This could be varied. The characters could be written before or in-between as well.

The decoding function works oppositely to the encoding function. First, we only want to look at the zero-width characters. The characters from the public message can be discarded. Then we access the two lists in exactly the opposite order. The result will be the binary string, each character separated by a space. To transform the binary back into the character, we transform the binary into an integer with int(b,2) and then the ASCII integer into the corresponding character with the char() function. This results in the secret message.

Since there is a whole list of zero-width characters and the mapping to the binary characters can be done arbitrarily, I decided to implement a simple ‘brute fore’ decoding. First, the three used zero-width characters have to be determined. It has to be exactly three because there are three binary characters that need to have a corresponding zero-width character.

Next, we need to decode the string for each possible order/permutation of the three zero-width characters. There are six options. I used the itertools library to generate all possible permutations. Some of these permutations could lead to very big binary numbers that are too big to be an integer. In this case, the particular permutation cannot be the original solution and they are simply skipped.

The result of the function will be a maximum of six different strings. It lays by the user to figure out what was the original secret message. Generally, this should be obvious. 4. Practical Deployment, Analysis & Case Studies I implemented a helper function to display the lists with zero-width characters. It is necessary to use .encode() with these characters to see the Unicode representation like "\u2060" , since the whole point of these characters is that they are not visible.

Finally to make a functional tool, I combined all of the functions above. For this, I decided to create a simple command-line tool. The tool first queries the options based on the choice it will ask for additionally necessary input. For the encoding function I added that the encoded result will be saved in a file. This makes it easier to copy the message and not lose the zero-width characters. This could have potentially been avoided if I had placed the characters inside the public message instead of behind it.

I also implemented the possibility to change what zero-width characters are used for the encoding and decoding. This allows for more flexibility. This was a very fun afternoon project. It made me revise my python skill and I learned something new about stenography, all while creating a tool that could be helpful in future CTF challenges. I hope you enjoyed my breakdown of the project.

I have hidden a secret message in the GitHub repository of ZW Steg . Can you find and encode it? Self destructive Code in Python. A fun little experiment to get practice with Python. Specifically, handling files, encodings and encryption. Weekend project of creating a frequency words list in Swedish with the help of articles from the 8Sidor website. This is the first of two parts. It deals with Data Mining.

Hide secret messages inside plain text, images, audio, or video frames using five steganography methods, with password-based encryption. The hidden bytes are AES-encrypted before encoding, so even if an attacker detects the payload, they cannot read the message without the password. A self-contained browser demo (single HTML file, no dependencies, no backend) implements the same encryption and steganography in JavaScript using the Web Crypto API. Open the demo, hide a message in some cover text, send the result, and the recipient can extract it with the password.

This tool implements five steganography techniques. Each has different robustness properties, so choose based on how the cover will be transported. Insert invisible Unicode characters ( U+200B and U+200C ) into the cover text. The text looks identical to the naked eye. Each invisible character encodes one bit of payload.

Append a trailing space (bit 0) or tab (bit 1) to the end of each line of the cover text. This is the technique used by stegsnow and similar tools. Hide a payload in the least-significant bits of the R, G, and B channels of a PNG cover image. Each pixel carries three payload bits (one per channel), walked in scan order. Alpha is never touched, so transparency stays identical.

Hide a payload in the least-significant bit of each 16-bit signed PCM sample of a WAV cover. One payload bit per sample, walked in frame order, channels in order (L then R per frame for stereo). Hide a payload across the least-significant bits of the R, G, and B channels of a sequence of uniform-size PNG frames. The frames are treated as one big pixel grid — one shared length prefix spans the whole sequence, not per-frame.

Python 3.11 or newer. Runtime dependencies are cryptography (always) and Pillow (only for -m img ). The image import is lazy inside img_encode / img_decode , so text users do not need Pillow installed. pytest is required for tests. Pick zero-width for text that will be read by humans and copy-pasted as text. Pick whitespace for contexts that strip zero-width characters but preserve trailing whitespace (raw text files, some source code, plain text email). Pick image if the cover is a PNG you control end-to-end — it's the highest-capacity option and survives any lossless transport, but dies the moment anyone re-encodes it lossy. Pick audio if the cover is a 16-bit PCM WAV you control end-to-end — the payload rides each sample's LSB and is inaudible, but it dies the moment anyone re-encodes it through a lossy codec (MP3, AAC, OGG) or even a lossless re-pack that re-quantizes. Pick frames if the cover is a sequence of PNGs (e.g. extracted from a lossless video) — it's the same LSB math as image, scaled across frames, but H.264/MP4 containers are refused because lossy video codecs destroy spatial LSBs.

Steganography hides bytes from the eye, not from statistical analysis. The browser demo includes a Detect tab that: For the image method, python steg.py detect -m img reports the LSB distribution (how many ones vs zeros across all R/G/B channels) and a simple suspicious flag: a readable non-zero length header that fits inside the image's LSB capacity is itself the steganographic signal — random LSB noise would not produce such a tight length prefix. This is the honest minimum for a portfolio piece; a real chi-square steganalyzer is a follow-up.

For the audio method, python steg.py detect -m wav -i stego.wav reports the sample-LSB distribution (how many ones vs zeros across every 16-bit sample) and the same readable-header suspicious flag. The length header survives without the password, so detect can tell an attacker exactly how many bytes are hidden in the cover audio — the same honesty as the image method.

For the frames method, python steg.py detect -m frames -i stego_frames/ reports the frame count, aggregated LSB distribution across all frames, and the same readable-header suspicious flag. A single shared length header spans the whole sequence, so one declared length reveals how many bytes are hidden across all frames. This demonstrates a fundamental property of LSB-style steganography: it hides content from humans, not from analysis tools.

The password protects the message content, not the existence of the message. The test suite includes round-trip tests, fuzz tests (random byte payloads across random cover sizes), edge cases (empty cover, empty payload, truncated payload, corrupted ciphertext, wrong password, Unicode cover text, 1 MB payloads, RGBA alpha preserved, 8-bit-WAV refusal, cover-too-small capacity rejection, non-uniform-frame-dims refusal), and end-to-end tests driving the CLI through main() . The text, image, audio, and frames test modules are split for clarity.

The whitespace encoding scheme is the same idea used by Matthew Kwan's stegsnow ( SNOW ) - bits encoded as trailing spaces and tabs at the end of text lines. The zero-width Unicode technique is the same idea used by several open-source tools, including pyUnicodeSteganography and ZW Steg . Hide secret messages in plain text using whitespace or zero-width Unicode with password-based encryption. Includes steganalysis detect mode.

Large language models (LLMs) have gained significant popularity in recent years. Differentiating between a text written by a human and one generated by an LLM has become almost impossible. Information-hiding techniques such as digital watermarking or steganography can help by embedding information inside text in a form that is unlikely to be noticed. However, existing techniques, such as linguistic-based or format-based methods, change the semantics or cannot be applied to pure, unformatted text. In this paper, we introduce a novel method for information hiding called Innamark, which can conceal any byte-encoded sequence within a sufficiently long cover text. This method is implemented as a multi-platform library using the Kotlin programming language, which is accompanied by a command-line tool and a web interface. By substituting conventional whitespace characters with visually similar Unicode whitespace characters, our proposed scheme preserves the semantics of the cover text without changing the number of characters. Furthermore, we propose a specified structure for secret messages that enables configurable compression, encryption, hashing, and error correction. An experimental benchmark comparison on a dataset of 1 000 000 Wikipedia articles compares ten algorithms. The results demonstrate the robustness of our proposed Innamark method in various applications and the imperceptibility of its watermarks to humans. We discuss the limits to the embedding capacity and robustness of the algorithm and how these could be addressed in future work.

K eywords Blind watermarking ⋅ \cdot copyright protection ⋅ \cdot data hiding ⋅ \cdot data sovereignty ⋅ \cdot digital text watermarking ⋅ \cdot information hiding ⋅ \cdot steganography ⋅ \cdot Unicode characters. Interest in LLM has grown rapidly in recent years, with a variety of promising applications emerging for individuals and businesses. The enduring process of digitization has led to numerous documents being stored directly in a machine-readable format that can be processed with LLM . However, it is becoming increasingly difficult to protect this intellectual property, especially when data are shared. In addition, recent improvements in AI-generated text make it increasingly challenging to distinguish between text written by a human and text generated by an LLM [ 1 ] . This can make it more complicated to maintain control over data, often discussed under the umbrella term data sovereignty [ 2 , 3 , 4 ] . Information-hiding techniques such as digital watermarking or steganography can help to address these concerns by hiding information in a cover document [ 5 , 6 , 7 , 8 , 9 ] .

Researchers and practitioners have developed a variety of methods for hiding data in different files, such as image, video, audio, or text files, of which the latter are the most challenging [ 7 , 10 ] . Those techniques can be classified as watermarking or fingerprinting methods, which focus on robustly storing copyright information and securing intellectual property, and steganography methods, which focus on encoding secret information imperceptibly [ 5 , 6 , 7 , 11 ] . To hide information in text, format-based methods shift words or lines or change fonts or text colors, whereas linguistic-based methods replace words with synonyms or generate new text [ 8 , 12 ] . Recently, researchers have proposed and discussed the possibilities for watermarking and steganography in LLM [ 13 , 14 , 15 , 16 , 17 ] . This is motivated by political regulations like the European Union’s AI Act, which states that AI-generated texts must be detectable and mentions watermarks and fingerprints as possible solutions [ 18 ] .

However, existing approaches show significant drawbacks in real-world use cases. For example, words cannot be replaced with synonyms in legal cover texts, as small semantic changes can have profound legal impacts. Format-based methods that employ line shifts or font colors cannot be applied to plain text files. Other methods using specific characters like Unicode confusables or spaces without width, called zero-width characters, are either visually recognizable by humans or not robust in different applications when using simple copy-and-paste tampering attacks [ 9 ] .

To close this gap, we extend the method proposed in [ 19 ] and call it Innamark. This method can hide any byte-encoded string inside a cover text by replacing all classical whitespace characters with a curated set of similar-looking whitespace characters from the Unicode standard [ 20 ] . This leads to a text with a secret message hidden inconspicuously inside. This approach is applicable to plain text in different file formats due to its format independence, and the secret message remains when copied and pasted without alerting users. Our design can support optional functionalities like compression, encryption, hashing, or error-correcting codes. This makes it usable for both watermarking and steganography use cases. To sum up, the paper makes the following concrete contributions: We propose Innamark, an information-hiding technique that can hide any byte-encoded sequence inside a cover text.

We introduce InnamarkTags, a specific secret message structure, to enable compression, encryption, hashing, and error-correcting codes to strengthen the security and robustness further. 5. Performance Evaluation & Extended Technical Observations We conduct a comparison with related work in an implemented testbed of ten algorithms.

The remaining sections of this paper are structured as follows: The necessary background information and nomenclature are introduced in Section 2 . An overview of similar algorithms and concepts is presented in Section 3 . Our proposed embedding and extraction technique is detailed in Section 4 , including information about our reference implementation. The results of a benchmark evaluation are presented in Section 5 and discussed in Section 6 . The paper concludes in Section 7 , with additional information in the Appendix.

Distinguishing between the different terminologies used in the domains of cryptography and information hiding is crucial and has been discussed comprehensively in the literature [ 21 , 9 , 5 , 11 , 22 ] . Starting with the broadest concept, “information hiding is the science of concealing a secret message or watermark inside a cover media (a host file/message) for providing various security purposes such as content authentication, integrity verification, covert communication, and so on” [ 9 , p. 56] .

Information hiding can further be divided into steganography and watermarking. It is distinct from cryptography because, at its root, it is not about transforming plain text into an encrypted cipher text [ 21 ] . A detailed survey and classification of information-hiding techniques has been published in [ 5 ] . The process of hiding a secret message inside a cover medium “in a way that one cannot detect it” [ 7 , p. 6367] is termed steganography . Techniques used to perform steganography can be classified into character-level, bit-level, and hybrid methods [ 23 ] . Another definition is as follows: “Steganography embeds a secret message inside an innocent looking cover medium, stealthily, without creating any attention. The cover medium used can be a text, image, audio, video, network packets, etc.” [ 23 , p. 1] .

In contrast, digital watermarking focuses on inserting “a visible or an invisible, preferably the latter, identification code that permanently is embedded in the data” [ 24 , p. 230] . Watermarked data assets can range from images, audio, and video to the under-researched and most difficult cover medium of plain text [ 10 ] , often referred to as digital watermarking, text watermarking, or digital text watermarking. An overview of the definitions that have arisen over time is presented in Table 1 .

To bring everything together, Rizzo et al. [ 11 , p. 97] summarize the concepts as follows: “While cryptography algorithms make unreadable the information by applying a kind of permutation or substitution to the original content, the steganography algorithms provide techniques to hide new information into the carrier, that is a readable document. Whereas watermarking algorithms ensure the authentication and the copyright protection by applying a watermark to the digital content.” The existing methods can be further classified according to the following attributes based on [ 5 , 22 , 26 ] : Cover Medium: The type of data in which the secret message is embedded, such as image, audio, video, or text files [ 5 ] .

Imperceptibility: The secret message can be embedded visibly or invisibly inside the cover [ 22 , 26 ] . Blindness: A blind method allows the secret message to be extracted without knowledge of the original cover, while a non-blind method requires the original cover for extraction [ 22 , 26 ] . Robustness: A robust method can withstand attacks and intentional or unintentional modifications, whereas a fragile method can not [ 5 , 22 ] .

Our proposed method is an invisible and blind method that uses text as the cover medium, aiming for high robustness. In this subsection, we introduce the notation used in this paper to describe our proposed method, which follows [ 27 ] . All iterable elements in the algorithmic descriptions, like lists, are indexed starting at one. Since the information-hiding scheme is based on plain text, let u u be a member of the set I := { u : u \mathcal{U}:=\{u:u is Unicode character } \} of the 154 998 characters in version 16.0.0 of the Unicode standard [ 20 ] . Let s s be a Unicode whitespace character with positive width, and let I := { s : s \mathcal{S}:=\{s:s is space character ∧ s ∈ U } \land\ s\in U\} be the set of all 17 such characters in this version of the standard. A character like the zero-width space (U+200B) “although called a ‘space’ in its name, does not actually have any width or visible glyph in display (…) and is treated as a format control character, rather than as a space character” [ 20 , p. 326] and, therefore, is not an element of I \mathcal{S} . We define the classical and most commonly used space character U+0020 as δ ∈ I \delta\in\mathcal{S} . We initially evaluated every s s in [ 19 ] to define our own subset of whitespace characters as the alphabet I + := { a : a ∈ S ∧ a ∈ U ∧ a \mathcal{A}_{+}:=\{a:a\in S\land a\in U\land a meets criteria } \} , where the criteria are non-noticeability for humans and robustness in different applications and file formats.

For the non-noticeability or visibility criteria, we compared the widths of the whitespace characters, taken from [ 28 ] , with that of the standard space δ \delta ( ≈ 1 / 4 \approx 1/4 em). If abnormalities are present that cause unusual space, we classify the character as having a different visibility from δ \delta , depicted as “” in Table 2 . When the difference is not noticeable, “” is shown ( ≈ 1 / 3 \approx 1/3 to 1 / 5 1/5 em), whereas “()” indicates that the difference could be noticeable to human eyes (e.g., 1 / 2 1/2 or 1 / 6 1/6 em).

For the application and file type robustness criteria, we tested the different whitespace characters in text (.txt) files, Microsoft Word files (.docx), PDF files created using Word, emails, and Microsoft Teams Chat. All tests were executed on Windows, Linux (Ubuntu), and macOS for operating system independence. These file types and programs were selected because they are considered industry standards for office and collaboration tools in many fields, except phone calls and SMS [ 29 ] .

Only the three-per-em space (U+2004), the punctuation space (U+2008), the thin space (U+2009), the narrow no-break space (U+202F), and the medium mathematical space (U+205F) are not noticed by humans and are robust in most of our tested applications and file formats. Therefore, these form the whitespace homoglyph alphabet I + \mathcal{A}_{+} ; their names are bold in Table 2 . Thus, we can see that I + ⊂ I ⊂ I \mathcal{A}_{+}\subset\mathcal{S}\subset\mathcal{U} . Our proposed Innamark technique, introduced in Section 4 , uses four of the five elements of I + \mathcal{A}_{+} to encode the secret message because one element ϕ ∈ A + \phi\in A_{+} is used as a separator character. We denote the alphabet without the separator character as I − \mathcal{A}_{-} , where I + = I − ∪ { ϕ } \mathcal{A}_{+}=\mathcal{A}_{-}\cup\{\phi\} and ϕ ∉ I − \phi\notin\mathcal{A}_{-} . Depending on the final application, the modular design of our proposed technique allows the usage of other characters in I + \mathcal{A}_{+} if a different set is needed due to framework restrictions or the requirements of specific use cases. A summary of the notation is presented in Table 3 .

Over time, a variety of information-hiding algorithms and implementations for watermarking and steganography have been published. Due to the increasing diversity of methods, cover media, and applications, several literature reviews and surveys have been published to organize the cluttered research and application landscape. A more detailed discussion of selected methods is provided in section 3.1 .

Bender et al. [ 30 ] provided one of the first comprehensive overviews of data-hiding methods for image, audio, and text files. Later on, Petitcolas et al. [ 5 ] published a survey on information-hiding techniques, focusing on steganography, watermarking, and fingerprinting, including information about possible attacks and a basic overall theoretical framework. More specialized overviews with solutions focusing on text steganography have been provided by Ahvanooey et al. [ 31 ] , Krishnan et al. [ 23 ] , and Majeed et al. [ 8 ] . Current challenges are discussed by Ahvanooey et al. [ 9 ] and Tyagi et al. [ 32 ] , with the latter considering concrete application possibilities.

In addition to reviews, researchers have formally compared existing methods to identify their strengths and weaknesses. Ahvanooey et al. [ 33 ] compared watermarking and steganography methods by differentiating their embedding techniques and evaluating them according to the criteria of imperceptibility, embedding capacity, robustness, security, and computational cost [ 33 ] . One of the latest evaluations of text steganography methods was published by Knöchel and Karius [ 34 ] , who compared their capacity, imperceptibility, robustness, and complexity with a specialized focus on malware.

To situate our proposed Innamark method within the research landscape, we consider the most relevant text watermarking and steganography methods. In the LLM problem domain initially set out, Kirchenbauer et al. [ 13 ] and Christ et al. [ 14 ] presented token-based watermarking schemes, with the latter focusing on undetectability, completeness, and soundness. These ideas were integrated into SynthID, the watermarking engine used by Google’s Gemini LLM [ 16 ] . Steinebach [ 15 ] generated a text based on sets of letters. These methods are classified as linguistic since they make use of LLM text generation. Such methods are problematic for cover texts whose semantics are essential. Thus, we focus on format-based methods that use insertion- or substitution-based embedding techniques [ 34 ] . Other types of format-based methods, as well as linguistic and random or statistical generation methods [ 8 , 34 ] , are not considered further since either they do not work on plain text documents due to the lack of formatting options or they change the semantics or structure of the cover text. We implemented all the methods presented here for our benchmark evaluation in Section 5 . A summary is provided in Table 4 .

One of the oldest whitespace steganography methods for ASCII texts is SNOW ( SNOW ) [ 35 ] . Although the first release goes back to the 20th century, the last update, with a change to the open-source Apache 2.0 license, was made in 2013. It has Java and Windows DOS versions and a C implementation last updated in 2016 [ 36 ] . The embedding process encodes the secret message into tab and space characters and appends it to the cover text, starting with a tab character under the consideration of a predefined line length [ 35 ] . Upstream compression and encryption can be enabled before the encoding process.

A well-known algorithm in the field of information hiding for text documents is UniSpaCh, proposed by Por et al. [ 6 ] . It is an extended version of WhiteSteg, which replaces a single whitespace character between two words or paragraphs with either one or two characters to encode a zero or one [ 37 ] . UniSpaCh uses two different methods to embed the secret message in the text. For spaces between words and sentences, regular whitespace characters either remain as they are or are extended by adding a thin, six-per-em, or hair space to encode two bits per embedding location [ 6 ] . For end-of-line and inter-paragraph spacings, the remaining space is filled with a combination of hair, six-per-em, punctuation, and thin spaces to encode two bits per character [ 6 ] .

Ahvanooey et al. [ 21 ] proposed a text steganography technique for SMS or social media communication. The embedding method transforms the secret message into zero-width characters with a Gödel function and uses the sending/receiving time and the length of the secret message to insert it before the cover text. The data hiding method proposed by Shiu et al. [ 38 ] focuses on communication over messengers of social media networks.

Due to the small width of social media messaging windows, the method is based on a fixed line length and can hide three bits per line of the cover text [ 38 ] . After encoding a secret message into a bit stream based on the ASCII mapping, it embeds the first bit by adding a whitespace at the end of a line, changing the length of the line to embed the second bit, and adding a whitespace between two words to embed the third bit [ 38 ] .

A text-watermarking technique based on replacing Unicode characters with specific confusables, also known as homoglyphs, was initially proposed in [ 11 ] and extended to a fine-grain watermarking approach in [ 22 ] . The latter method generates a watermark by using a keyed hash function with a secret message as a watermark and a secret password [ 22 ] . Afterward, the watermark is embedded in the cover text by replacing specific characters with their confusables or leaving them unchanged to embed one bit in each and replacing spaces with a set of specific whitespace characters to embed three bits in each [ 22 ] .

The open-source implementation StegCloak published by [ 39 ] , as described in [ 40 ] , is a JavaScript steganography tool that is able to hide a secret message inside a cover text with optional password encryption and HMAC ( HMAC ). In the embedding process, the secret message is compressed, optionally encrypted, and encoded in a set of zero-width characters to be inserted in one location after a classical whitespace of the cover text [ 40 ] .

Another implementation is the Unicode Lookalikes algorithm by [ 41 ] as part of the Python package pyUnicodeSteganography. Similar to [ 22 ] , the method replaces specific characters with their confusables to encode a secret message inside the cover text [ 41 ] . Ahvanooey et al. [ 42 ] presented a multilingual steganography method focusing on short messages in social media networks.

Like the previous approach in [ 21 ] , four zero-width characters and a timestamp are used to encode the secret message. Further, a password-based approach with a OTP ( OTP ) and an XOR operation are used to transform the secret message into an encrypted bit stream that is appended to the cover text [ 42 ] . The data-hiding approach of Shazzad-Ur-Rahmen et al. [ 43 ] can embed five bits per embeddable location, whereas their updated version [ 44 ] can embed six. The main idea of the latter procedure is to encrypt the secret message using AES and convert the resulting binary stream into blocks of six bits [ 44 ] . With the help of two lists, specific Unicode characters are replaced with their confusables, and whitespace characters are replaced with a particular combination of smaller whitespace characters to embed the secret message in the cover text [ 44 ] .

In this section, we present Innamark, our invisible and blind information-hiding technique for plain text. Since existing methods either lack robustness in some applications, increase the number of characters, or are recognizable by humans, they are unsuitable for the LLM use case described in Section 1 . Therefore, this section presents the embedding and extraction method in Algorithm 1 and Algorithm 2 based on our nomenclature introduced in Section 2.2 . It further includes a concrete example based on some Lorem ipsum dummy text and information about our implemented prototypes.

The proposed embedding method, detailed in Algorithm 1 , can hide any byte-encoded sequence in a Unicode-encoded cover text C I T CT . The examples in this paper are based on a secret message S I M SM in text form, in which every character is transformed into its UTF-8 byte representation S I M b I y I t I e I s SM_{bytes} . The embedding function E I m I b I ( C I T , S I M b I y I t I e I s , θ ) Emb(CT,SM_{bytes},\theta) begins by analyzing the configuration parameter θ \theta . This specifies the type of the secret message, which we call a InnamarkTag . It offers optional functionalities that can be enabled in any combination by the end user, namely, encryption, compression, hashing, and error-correcting codes. Depending on the user’s choice, θ \theta defines the type used to calculate the tag . The tag has a fixed length of one byte and is returned by the a I p I p I l I y I T I a I g applyTag method with the updated secret message, depending on the user’s choice. Each bit in the tag indicates whether an option, such as compression, is enabled ( 1 1 ) or not ( 0 0 ). Thus, the tag describes the format of the secret message, similar to tags or headers in network packets [ 46 ] . Fig. 1 provides an overview of the InnamarkTag structure, the definition of each bit in the tag, and an example of a tag with enabled compression (second compression bit set to one) and error correction (fourth CRC32 bit set to one).

An InnamarkTag starts with the separator character ϕ \phi , followed by the tag with a fixed length of one byte, followed by an optional prefix whose content depends on the tag, followed by the secret message itself. Next, the encoding process starts transforming the secret message with the InnamarkTag tag and optional prefixes S I M b I y I t I e I s SM_{bytes} into a sequence of whitespace characters S I M H SM_{H} from our homoglyph alphabet I − \mathcal{A}_{-} . Since | I − | = 4 |\mathcal{A}_{-}|=4 , where | ⋅ | |\cdot| denotes the cardinality, each byte of the secret message is represented by four elements of I − \mathcal{A}_{-} because Harvested Online Documentation & Reference Sources • https://en.wikipedia.org/wiki/List%20of%20steganography%20techniques • https://zerotraceai.net/guides/zero-width-steganography • https://wiki.athena-ctf.com/docs/steganography/text-steg/whitespace-steg • https://saman-ghorayshi.github.io/text-steganography/zero-width.html • https://www.aperisolve.com/wiki/techniques/text • https://ctf.support/steganography/text-steganography/ • https://www.aperisolve.com/wiki/cheatsheet/text • https://github.com/dapperfu/whitespace-stego • https://saman-ghorayshi.github.io/text-steganography/whitespace.html • https://mayadevbe.me/posts/projects/zw_steg/