Steganography Basics: Hidden Data in Files, Explained
Steganography just means hiding data inside something that looks ordinary — a photo that opens fine, a document that reads normally, a block of text with nothing visibly odd about it. Unlike encryption, which scrambles data so it's obviously protected, steganography's whole point is that you don't notice anything is there at all. Most people will never build a hidden message on purpose, but it helps to know the categories, because some of the same techniques show up unintentionally — left behind by editing tools, AI generators, or export pipelines you didn't choose.
The main categories
- Metadata fields. The simplest and most common case: extra text tucked into a file's official metadata slots — EXIF comments, XMP fields, PDF document properties. Nothing is "hidden" in a technical sense; it's just sitting in a place most viewers never look. This is the category scrub deals with directly.
- Invisible text characters. Zero-width spaces, zero-width joiners, and other characters with no visible glyph can be woven into ordinary text to carry a payload — a serial number, a tracking tag — that's invisible to a reader but present in the raw character stream. See our piece on zero-width characters for how this shows up in practice.
- Appended data. Extra bytes tacked onto the end of a file, after the part a normal viewer reads. A JPEG decoder stops at the end-of-image marker; anything after it is invisible to the viewer but still part of the file. This is a favorite because it doesn't disturb the visible content at all.
- Pixel-level encoding. Techniques like least-significant-bit encoding change individual pixel values by amounts too small to see, spreading a payload across the image data itself. This is a deeper form than the ones above and generally requires purpose-built tools to both write and read.
- Statistical / model-level watermarks. A newer category: some AI image and text generators bias their output in subtle statistical ways — patterns spread across the whole file or the whole text, not stored in any one field. These are designed to survive normal edits and resaving, which is a fundamentally different problem from the categories above.
What's easy to deal with, and what isn't
Be honest with yourself about which category you're facing, because the fix is different for each:
- Metadata fields, appended data, and invisible text characters are all things scrub can find and remove — they sit in a distinct, removable location in the file, so stripping them doesn't touch the visible content.
- Pixel-level encoding and statistical watermarks are a different animal. A fragile pixel-level watermark can break just from resaving or light editing. A robust watermark (like Google SynthID) or a statistical text watermark is engineered specifically to survive that kind of tampering — it's spread across the whole file rather than stored in one spot, so there's no clean field to strip. Removing one reliably generally means recreating the content, not editing the file. Be skeptical of any tool that claims otherwise.
Why check at all
Most files you handle day to day aren't deliberately steganographic — but they're often carrying more than you think anyway: your camera's GPS coordinates, an old author name in a document's XMP, or invisible characters left behind by a text tool. Checking a file before you send it isn't paranoia, it's the same instinct as re-reading an email before you hit send.
The short version
"Hidden data in a file" covers a wide range, from ordinary metadata fields to statistical watermarks built to resist removal. scrub checks your files locally for the removable kinds — metadata, invisible characters, and appended data — and tells you plainly when something (like a robust watermark) is outside what it can strip.