• Irongeek Security
• Hacking Illustrated Videos
• InfoSec Articles
• Mobile Pen-testing Tools
• Apps/Scripts
• Reviews
• RSS
• Your IP
• Podcasts
• Hoosier Hackers
• Newscat
• Links
• Contact
• Forums
• Workout
• Nutrition
• Supplements
• Humor
• Irongeek Campuses
• Fed Watch
• Books
• Store
• About
• Follow @irongeek_adc



Unicode Text Steganography Encoders/Decoders

    The idea of this page is to demo different ways of using Unicode in steganography, mostly I'm using it for Twitter. :) I have some notes on the bottom about how these Unicode characters show up or get filtered by some apps. Most of the algorithms should work ok on Twitter, Facebook however seems to strip out more characters. There seems to be no perfect character set.

Unicode Tags Stego:
 

This one uses non-printable tags in the range U+E0000 to U+E007F hidden after the spaces (or at the end of the cover text). You must have at least one space. Also, if you are using a client that shows tags as extra spaces, you may want to use the "Put all Tags at the end" option.

Cover Text To Use:		0
Input (output if decoding):		0
Stegotext (input if decoding):		0
	Distribute Tag In Spaces Put all Tags at end

More Advanced Unicode Stego:
 

This one is more complex than the one below, and uses better looking Homoglyphs. Mostly it uses whitespace for encoding. Got some ideas and suggestion from Mick Douglas on this one. It uses 7 bit ASCII to save space.

Cover Text To Use:		0
Input (output if decoding):		0
Stegotext (input if decoding):		0

Butt Ugly Latin Wide Version:

This one is a bit crappy and causes a "ransom letter" type of look. It encodes bits by alternating between normal and full width Latin. It uses 7 bit ASCII to save space.

Cover Text To Use:		0
Input (output if decoding):		0
Stegotext (input if decoding):		0

Notes:

Zero Width:
aU+180E U+200B U+200c U+200d U+FEFF U+2060 U+2061 U+2062 U+2063 U+2064
Test string: a᠎b​c‌d‍ef⁠g⁡h⁢i⁣j⁤k
Chrome: U+180E shows as box. All else look good
On Android Twitter: U+200B U+200c U+200d U+FEFF are only ones that show with no space.
On IE: Only U+200B U+200c U+200d U+FEFF U+2060 U+2062 showed no space, U+200c shows as a vertical line, U+200d as a the same line with an x at the tope
Twitter on iOS: U+180E and U+2064 show as boxes, except in zoom where U+180E shows as a box.
Facebook strips: U+200B U+FEFF
Winners? U+200B U+200c U+200d U+FEFF

Spaces:
U+00A0 U+180E U+2000 U+2001 U+2002 U+2003 U+2004 U+2005 U+2006 U+2007 U+2008 U+2009 U+200A U+202F U+205F U+3000
Test string: a b c᠎d e f g h i j k l m n o p q　r
Outlook: U+2005 becomes a real space
Twitter: Turns U+00A0 into real space
Facebook strips: Only allows U+180E U+205F U+3000, U+00A0 becomes a space
Safari and Chrome: U+200A looks a little short
On Android Twitter: Most look ok, except maybe U+200A
Most compatible spaces assuming not on Facebook: U+0020 U+2004 U+2005 U+2006 U+2008 U+2009 U+202F U+205F

Line and Paragraph Separators:
U+2028 U+2029
Test string: a b c
Facebook strips all.
Twitter replaces with: U+2070

Unicode Tags:
U+E0000 To U+E007F Unicode tags
Firefox: Looks good
iOS client: Shows boxes
Chrome OS X and Windows: Shows boxes
Android Twitter: Extra spaces

Printable version of this article