How It Works: Technical Steganography & In-Browser Cryptography

Steganography is the science of hiding secret data inside an innocent carrier medium without drawing suspicion. Here is an authoritative technical explanation of how HideMyMessages executes emoji, text, and image steganography strictly within your browser sandbox with zero server uploads.

1. Emoji Steganography (Unicode Plane 14 Tag Architecture)

In modern computing environments, text rendering is managed by typography layout engines such as Apple CoreText (iOS/macOS), Google HarfBuzz (Android/Linux), and Microsoft DirectWrite (Windows). Under the official Unicode Technical Standard #51 (UTS #51), Plane 14 contains 95 Tag characters spanning from U+E0020 (TAG SPACE) through U+E007E (TAG TILDE).

These tag codepoints correspond 1:1 with printable ASCII characters, shifted by a fixed hexadecimal offset of +0xE0000:

When appended behind a carrier emoji (such as 🤫, 😊, or 🍕), font rasterizers assign them an advance width of zero pixels. Visual observers see only the carrier emoji, while copying the emoji copies the invisible tag codepoints into the clipboard.

2. Text Steganography (Zero-Width Binary Interleaving)

Instead of emojis, text steganography conceals secrets between the visible words of an ordinary sentence using non-printing typographical control codepoints:

• Zero-Width Space (U+200B): Encodes binary bit 0.
• Zero-Width Non-Joiner (U+200C): Encodes binary bit 1.
• Zero-Width Joiner (U+200D): Frame start and end delimiter.

A message byte (8 bits) is converted into an 8-character sequence of invisible spaces. Because these characters have zero horizontal width, they can be inserted between the words of an ordinary business email or article with zero visible layout deviation.

3. Image Steganography: PNG LSB vs. JPEG Comments

Embedding data into digital photographs depends on whether the file format is lossless or lossy:

A. Lossless PNG (Least Significant Bit Substitution)

In 24-bit TrueColor PNG images, each pixel consists of Red, Green, and Blue 8-bit channels (0 to 255). Modifying the least significant bit (LSB) changes the color value by at most 1/255 (<0.4%):

A 1920x1080 photograph contains over 6.2 million individual color channels, allowing up to 750 Kilobytes of encrypted data to be embedded without humanly perceptible changes.

B. JPEG Comment (COM) Segment Insertion

Because JPEG compression discards high-frequency pixel details during Discrete Cosine Transform (DCT) quantization, LSB modifications are destroyed upon re-compression. HideMyMessages inserts text data into JPEG COM (Comment) markers (0xFFFE), bypassing the lossy compression engine completely.

4. Defense-in-Depth: Authenticated Client-Side Cryptography

Concealment alone is vulnerable if an observer discovers the presence of non-printing characters. HideMyMessages implements a defense-in-depth model using authenticated client-side encryption before concealment:

1. PBKDF2 Key Derivation: Your user-supplied passphrase is processed through PBKDF2 using SHA-256 and 100,000 iterations to derive a cryptographically strong 256-bit AES key.
2. AES-256-GCM Cipher: The plaintext is encrypted using AES in Galois/Counter Mode (GCM), generating an initialization vector (IV), ciphertext, and an authentication tag that verifies message integrity and prevents tampering.
3. Zero Server Transmission: All cryptographic functions execute natively in hardware RAM via window.crypto.subtle. Plaintext, keys, and decrypted data never leave your browser sandbox.

5. Platform Compatibility & Transmission Verification