Stegano

About

Stegano scans any web page for hidden Unicode characters and gives you tools to encode, encrypt, and decode them yourself. Built for AI red teamers, security researchers, and anyone who wants to see what's really in the text they're reading.

What it detects:
 - Tags block characters (U+E0000-E007F) used in ASCII smuggling and prompt injection
 - Zero-width characters (joiners, non-joiners, direction marks) used in fingerprinting and tracking
 - AI watermark spaces (thin space, hair space, narrow no-break space) inserted by LLM providers
 - Encrypted hidden text (AES-256-GCM encrypted messages embedded as invisible Unicode)

How scanning works:
 - Click "Scan Page" or press Alt+Shift+S to scan the current page
 - Hidden characters are highlighted inline with color-coded markers: yellow for tags, orange for zero-width, pink for watermarks, cyan for encrypted
 - Click any cyan highlight to decrypt it inline with your password
 - The badge shows the count of hidden characters found (or a checkmark if clean)
 - Export findings as JSON for reporting

Encode & Decode tools:
 - Encode any text into invisible Tags block Unicode - the output looks like empty space but carries your message
 - Decode invisible text by pasting it into the decoder - instantly reveals the hidden content
 - Save frequently used encoded texts as snippets for quick access via the right-click context menu

Encryption (new in v1.5):
 - AES-256-GCM encryption with PBKDF2 key derivation (210,000 iterations)
 - Encrypt any message into invisible Unicode - undetectable and unreadable without the password
 - Optional compression for smaller encrypted payloads
 - Saved password manager for quick encryption and decryption
 - Password-linked snippets for one-click encrypted paste

Settings & customization:
 - Three sensitivity levels: Standard, Thorough, Paranoid - each adds more character ranges
 - Customizable highlight colors per character class
 - On-demand or automatic scan mode (auto-scan requires host permissions)
 - Auto-copy encoded output to clipboard
 - Snippet paste mode: insert directly at cursor or copy to clipboard
 - Dark and light theme

Privacy:
 - No network calls. Ever. All processing happens locally in your browser.
 - Passwords are stored locally only - never synced or transmitted.
 - No data collection, no analytics, no tracking.