stegdoc

Hide files inside Office documents with AES-256 encryption and steganography

stegdoc is a CLI tool that encodes any file into legitimate-looking Office documents (Excel/Word). Your data is hidden within spreadsheets or documents that appear to contain normal server monitoring reports, while optionally being protected with military-grade AES-256-GCM encryption.

Features

• Steganography - Hide data in Excel spreadsheets (hidden sheets) or Word documents
• AES-256-GCM Encryption - Military-grade encryption with PBKDF2 key derivation (100k iterations)
• Realistic Decoy Data - Generated server metrics that make files look like IT monitoring reports
• Multi-part Splitting - Automatically split large files across multiple documents
• Smart Compression - Gzip compression for compressible files, skipped for images/video/archives
• Integrity Verification - SHA-256 hashing detects tampering
• Folder Support - Encode entire directories (automatically zipped)
• Interactive Mode - User-friendly prompts guide you through options

Installation

npm install -g stegdoc

Or run directly with npx:

npx stegdoc encode myfile.pdf

Quick Start

# Encode a file with encryption (recommended)
stegdoc encode secret.pdf -p mypassword

# Decode it back
stegdoc decode server_metrics_20251215_1200_A1B2.xlsx -p mypassword

# View file info without decoding
stegdoc info server_metrics_20251215_1200_A1B2.xlsx

# Verify file integrity
stegdoc verify server_metrics_20251215_1200_A1B2.xlsx -p mypassword

Commands

encode - Hide a file in an Office document

stegdoc encode <file> [options]

Options: | Option | Description | Default | |--------|-------------|---------| | -o, --output-dir <dir> | Output directory | Current directory | | -s, --chunk-size <size> | Split size: 5MB, 25MB, 3 parts, max/single/none | 5MB | | -f, --format <format> | Output format: xlsx or docx | xlsx | | -p, --password <pass> | Encryption password | None (unencrypted) | | --force | Overwrite existing files | Prompt | | -q, --quiet | Minimal output for scripting | Off | | -y, --yes | Skip interactive prompts | Off |

Examples:

# Basic encoding (will prompt for options)
stegdoc encode document.pdf

# Encode with password and Word format
stegdoc encode document.pdf -p mysecret -f docx

# Split into exactly 3 parts
stegdoc encode large-video.mp4 -p mysecret -s "3 parts"

# No splitting (single file output)
stegdoc encode archive.zip -p mysecret -s max

# Encode a folder
stegdoc encode ./my-folder -p mysecret

decode - Recover the original file

stegdoc decode <file> [options]

Options: | Option | Description | Default | |--------|-------------|---------| | -o, --output <path> | Output file path | Original filename | | -p, --password <pass> | Decryption password | Prompt if needed | | --force | Overwrite existing files | Prompt | | -q, --quiet | Minimal output | Off | | -y, --yes | Skip prompts, fail if password needed | Off |

Examples:

# Decode with password
stegdoc decode server_metrics_20251215_1200_A1B2.xlsx -p mysecret

# Decode to specific location
stegdoc decode report.xlsx -p mysecret -o ./recovered/original.pdf

# Multi-part files are auto-detected
stegdoc decode server_metrics_20251215_1200_A1B2_part1.xlsx -p mysecret

info - View metadata without decoding

stegdoc info <file>

Displays:

• Original filename and size
• Encryption status
• Compression status
• Part information (for split files)
• Content hash for verification

verify - Validate file integrity

stegdoc verify <file> [options]

Options: | Option | Description | |--------|-------------| | -p, --password <pass> | Verify password is correct |

Checks:

• Metadata integrity
• All parts present (for multi-part files)
• Password validity (if provided)

How It Works

Encoding Pipeline

Input File
    ↓
[Compression] → gzip (if beneficial)
    ↓
[Base64 Encoding]
    ↓
[Encryption] → AES-256-GCM (optional)
    ↓
[Office Wrapper] → XLSX or DOCX
    ↓
[Decoy Layer] → Server metrics data
    ↓
Output File(s)

File Storage

XLSX Format:

• Sheet 1 ("Server Metrics"): Visible decoy data - looks like IT monitoring reports
• Sheet 2 ("Data"): Hidden sheet containing your encrypted payload

DOCX Format:

• Embedded text with metadata and payload
• Appears as a system report document

Encryption Details

• Algorithm: AES-256-GCM (Galois/Counter Mode)
• Key Derivation: PBKDF2-SHA256 with 100,000 iterations
• Key Size: 256 bits
• IV: 96 bits (randomly generated)
• Salt: 128 bits (randomly generated)
• Authentication: 128-bit auth tag (GCM provides authenticated encryption)

Filename Generation

Output files use deterministic, realistic filenames:

server_metrics_YYYYMMDD_HH00_XXXX.xlsx
system_report_YYYYMMDD_HH00_XXXX.docx

The date/time and ID are derived from a hash, ensuring files from the same encoding session are related.

Use Cases

• Secure file transfer - Send encrypted files that look like mundane reports
• Backup storage - Store sensitive data in plain sight
• Privacy - Keep personal files private on shared systems
• Data portability - Office documents work everywhere

Backward Compatibility

Files created with previous versions are fully supported. The tool automatically detects and handles legacy formats.

Requirements

• Node.js 18.0.0 or higher

License

MIT License - see LICENSE for details.

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.