An AES-256-GCM encrypted password vault hidden inside BMP images.
- AES-256-GCM Encryption - Encryption with authentication tags
- Steganography - Data hidden in BMP image with lsb
- Password Protection - Master password with Argon2id key derivation
- Simple CLI - Commands for vault management
- Automatic Backups - Previous images preserved as
*_old.bmp
- Windows - Project targets Windows
- GCC - MinGW or similar compiler with AES-NI support
- Argon2 - Key derivation library (32-bit or 64-bit auto-detected)
- Crypto Libraries - Windows crypto API (crypt32, advapi32)
Simply run:
makeThe Makefile automatically detects your system architecture (32-bit or 64-bit) and deploys the corresponding argon2.dll.
make cleanRemoves all build artifacts and temporary files.
stegolock init image.bmpCreates an encrypted vault inside the BMP image. You will be asked for a master password.
stegolock add image.bmp github.comStores a username and password for a website.
stegolock get image.bmp github.comDecrypts and displays stored credentials.
stegolock list image.bmpLists all websites in the vault.
stegolock del image.bmp github.comRemoves a stored credential from the vault.
- Vault Serialization - Password entries packed into binary format
- Key Derivation - Master password → 256-bit key using Argon2 with random salt
- AES-256-GCM - Encrypts vault with AES-NI acceleration, random IV, and authentication tag
- Data Layout -
[Salt][IV][Tag][Ciphertext]embedded in image via steganography
Data is hidden in the least significant bits (LSB) of BMP pixel values.
Before modifying an image, the original is renamed to image_old.bmp. This preserves your vault in case of corruption or accidental overwrite.
- Master Password - Never logged or written to disk
- Argon2 KDF - Modern password hashing with tunable work factor against brute-force attacks
- AES-256-GCM - Hardware-accelerated with AES-NI for both confidentiality and authenticity
- Unique Salts - Each vault uses a random salt and IV
- Steganography - Data hidden in BMP lsb
- Backups - Original images preserved as
*_old.bmp(delete when no longer needed)
- Windows-only - Uses Windows API
- BMP images only - No support for JPEG, PNG, or other formats
- Image size - Must be large enough to hold encrypted vault (~1KB minimum recommended)
- Vault capacity - Limited by available image steganographic capacity
MIT