Text steganography is the practice of hiding a secret message inside ordinary-looking text so that anyone who glances at the file sees only the cover sentence, not the hidden payload. The trick relies on Unicode code points that most fonts render with zero width — characters you can paste and copy, but that take up no visible space on the page. A beginner-friendly tool like Text Steganography follows an explicit convention: it turns each UTF-8 byte of your secret into eight invisible bits, frames those bits with two more invisible marker characters, and slips the whole framed sequence right after the first visible code point of your cover. When the recipient pastes the result into reveal mode, the tool reads the markers, validates that every payload character is a zero-bit or a one-bit, checks that the bit count is a multiple of eight, then decodes the bits back into the original UTF-8 bytes. Nothing is uploaded — the encode and decode both run entirely in the browser, so neither the cover nor the secret ever leaves your device.
How Text Steganography Works (in Plain English)
Steganography is different from cryptography. Cryptography scrambles a message so an interceptor cannot read it; steganography hides the fact that any secret exists at all. Text steganography applies that idea to plain characters: a visible cover sentence carries a hidden payload inside it, and the payload is built from Unicode code points that no ordinary font shows on screen.
The convention used by the tool is deliberately inspectable. Four code points do all the work:
- A zero-width space (U+200B) stands in for a binary 0.
- A zero-width non-joiner (U+200C) stands in for a binary 1.
- An invisible separator (U+2063) marks where the payload begins.
- An invisible plus sign (U+2064) marks where it ends.
Every UTF-8 byte of your secret becomes exactly eight invisible bits, written most-significant-bit first. The framed sequence — start marker, bits, end marker — is inserted right after the first visible code point of your cover, so the string still begins with the same code point a reader expects.
The Zero-Width Building Blocks
You do not need to memorize the code points to use the tool, but knowing they exist makes the output less mysterious. Each of these characters is part of standard Unicode, which means any modern text editor can store and copy them. What they share is a property called "default ignorable": most rendering engines skip them when measuring how wide a line should be.
That property is exactly what text steganography depends on. Because a font gives them no advance width, the cover sentence keeps its line breaks and indentation. Because they are real code points, they survive copy and paste through any system that handles Unicode faithfully. Because they look invisible to the eye, only someone who knows to look for them — or who runs the text through a character counter or a code-point viewer — will suspect anything is there.
The convention's design choice to keep every code point explicit also means the transformation is fully reversible. The same tool that hid a message can extract it again, byte for byte, as long as the framing survived transit.
Hide Your First Message Step by Step
This walkthrough uses a short secret so you can see the whole round trip at a glance. Open the tool in your browser — no installation, no account, no upload.
- In the cover-text field, type a normal sentence you would not mind anyone seeing, such as "Meet me at the library after lunch."
- In the hidden-message field, type the secret you actually want to deliver. Keep it short at first; single words or short phrases are easier to verify. For example: "2pm".
- Click the action button to generate the steganographic string. The visible output will still read "Meet me at the library after lunch." to your eyes, but its underlying code-point sequence will be far longer than the sentence you typed.
- Use the copy button to grab the exact result. Do not retype it by hand — invisible characters are easy to drop, and one missing bit can corrupt the payload.
- Send that copied string to yourself through the channel you plan to use (an email draft, a chat message, a local text file) and paste it back into reveal mode as a round-trip test before you trust the channel with anything sensitive.
The cover limit is 100,000 code points and the hidden message is capped at 10,000 UTF-8 bytes, so even a fairly long secret will fit comfortably.
Worked example: suppose your secret is the two letters "Hi". "H" is U+0048; in UTF-8 that is the single byte 0x48, which in binary is 01001000. "i" is U+0069; in UTF-8 that is 0x69, which in binary is 01101001. Together the secret is 2 bytes × 8 bits = 16 invisible code points, with a start marker and an end marker added on top. Sixteen invisible characters is small enough to inspect manually with a Unicode inspector if you want to confirm what the tool produced.
Reveal a Message You Receive
Reveal mode is the reverse operation. You do not need to type the original cover or remember the secret — the framed sequence carries everything needed to recover both.
- Paste the full steganographic string into reveal mode exactly as you received it. Do not clean it up, do not run it through a "remove formatting" tool, and do not reformat line breaks.
- Trigger the reveal action. The tool looks for the start marker (U+2063) and the end marker (U+2064), then verifies that every payload character between them is either U+200B or U+200C.
- If the bit count is a multiple of eight and the bits decode to valid UTF-8, the tool returns the hidden message. It also returns the visible cover, reconstructed by stripping the framed sequence out of the original string.
- If anything fails — a missing marker, an unexpected character, a bit count that is not a multiple of eight, or bytes that do not form valid UTF-8 — the tool treats it as an error instead of guessing. That strict behavior is what makes the round trip trustworthy.
Why Messages Sometimes Disappear in Transit
The single most common beginner surprise is opening the message on the other end and finding nothing. Nothing went wrong with the tool; something on the transport stripped the invisible characters.
Many systems normalize or filter text behind the scenes. Social networks, email gateways, chat clients, content-management systems, and clipboard managers may treat default-ignorable code points as if they were not there, replace line endings, or reject the marker code points outright. Screenshots and printed copies cannot carry invisible code points at all — a PNG is a picture of pixels, and pixels do not encode U+200B.
This is why the documentation warns to copy the generated string only through a channel you have tested end to end. A plain-text editor that preserves Unicode exactly — for example, a local .txt file opened in a Unicode-aware editor — is far more likely to keep the payload intact than a web form that sanitizes pasted content. If extraction fails after transit, compare raw code points on both sides to find which application removed or changed the invisible characters.
The Unicode Security Considerations report discusses many of the same sanitization risks in a broader context, including why default-ignorable code points are often the first things filtered out of hostile input.
Steganography vs Cryptography: Know the Difference
A lot of beginner guides blur these two words, and that blur is worth clearing up before you trust any steganography tool with real data.
| Property | Text Steganography (this tool) | Classical Cryptography |
|---|---|---|
| Visible output | Looks identical to the cover sentence | Looks like scrambled text |
| What it hides | The existence of a secret | The content of the secret |
| Confidentiality | None — anyone who knows the convention can decode | Strong, when the algorithm and key are sound |
| Integrity / authenticity | None — anyone can edit the payload | Authenticated modes provide both |
| Typical use | Demos, puzzles, sanitizer testing, learning | Protecting credentials, messages, files in transit |
If you need to hide credentials, harmful instructions, personal data, or anything that breaks a platform's rules, encrypt it first with a reviewed system and then transport the ciphertext through whatever channel you like. Steganography on its own is concealment, not confidentiality.
Limits, Markers, and Code Points to Know
These numbers come straight from the tool's documented behavior, so you can plan around them instead of discovering them by trial and error.
| Item | Value |
|---|---|
| Maximum hidden message | 10,000 UTF-8 bytes |
| Maximum cover text | 100,000 code points |
| Bits per hidden byte | 8 (one byte becomes eight invisible characters) |
| Binary 0 symbol | U+200B zero-width space |
| Binary 1 symbol | U+200C zero-width non-joiner |
| Start marker | U+2063 invisible separator |
| End marker | U+2064 invisible plus |
| Where the frame goes | Right after the first visible cover code point |
| Processing location | Browser only — nothing is uploaded |
Because every hidden byte becomes eight additional code points plus two markers, a 10,000-byte payload will add roughly 80,002 invisible characters to your file. That is also why the cover limit exists — keeping the total code-point count predictable keeps the page responsive. Emoji and non-Latin text usually take more than one UTF-8 byte each, so the hidden "character count" you see in your editor is often smaller than the byte budget you actually consumed.
One more constraint worth remembering: the cover cannot already contain this convention's start or end markers. If it does, the tool will refuse, because accepting an existing marker would make payload boundaries ambiguous. Plain zero-width characters that sit outside the framed region, however, remain part of the visible cover and are passed through unchanged.
Quick Checks Before You Trust a Result
A short checklist is the easiest way to avoid the beginner traps.
- Run a self-test before you send anything important: hide a message, copy it, paste it back into reveal mode, and confirm both the hidden text and the recovered cover match what you typed.
- Pick the transport channel first and prove it carries invisible characters with a tiny test payload — even a one-letter secret is enough to verify the round trip.
- Remember that "the visible sentence looks the same" does not mean "the file is unchanged." The code-point sequence is much longer after embedding, and a character counter or a diff tool will reveal the extra characters immediately. That is fine if your audience is a puzzle solver; it is a problem if your audience is a security scanner.
- Keep the use case modest. Text steganography is great for learning how Unicode can carry non-rendering data, for harmless puzzles, and for testing how a sanitizer handles invisible input. It is not a substitute for encryption and it is not a reliable way to bypass a platform's content rules.
For readers who want the long-form reference — every code point, every limit, and a copyable step list — the Text Steganography Cheat Sheet: Codes, Limits, Steps collects the same facts in one place.
If you're weighing options, Text to Binary in Python: Byte-Exact UTF-8 in Practice covers this in detail.