Review: OpenPuff steganography tool hides confidential data in plain sight

Steganography, or hiding messages in plain sight, is a storied practice dating back to ancient Greece. In modern practice, steganography means taking a media file such as an MP3 or a jpeg image and burying data in it. The file still works as usual, and if you don't specifically look for the hidden data, you'll have no idea the encrypted information is even there. One good tool for this is OpenPuff,a powerful open-source steganography application that supports a wide variety of "carrier" formats for hiding data in, including MP3, JPG, and more.

For example, you could hide an important text message in an image file, and then post that file publicly online. Another party could then download the file and—using OpenPuff and a password you both shared in advance—process the file and extract whatever information you've buried in it.

By default, OpenPuff asks you to protect your information with three different passwords, although it does let you dial that down to just a single password. It even supports plausibly deniable encryption, and this is where things get really paranoid: Even if someone somehow realizes your seemingly innocent image or music file contains a hidden message, OpenPuff lets you hide a decoy along with the real message. Simply provide a different password, and the other person will extract the decoy out of the image, thinking they've won–but actually, your real secret will still be hidden in the file.

Steganography usually works well for hiding short text messages or other condensed information; obviously, you can't hide an entire video file within another video file using steganography–there's just no room for all of those extra bytes. Still, if you need to hide a large amount of information, OpenPuff lets you chain multiple carrier files together into one large message. To extract the information, the recipient (or yourself) needs to have all of the carrier files, and feed them into OpenPuff in exactly the right sequence, along with the correct password or passwords. Not for the faint of heart.

Note: The Download button on the Product Information page will download the software to your system.