kurolabs/stegcloak

StegCloak is a JavaScript tool for hiding secret messages inside ordinary-looking text. The trick it uses is called steganography, which means concealing information inside something that appears innocuous. Instead of hiding data inside images (a common approach), StegCloak hides data inside regular sentences using invisible unicode characters that browsers, social media platforms, and messaging apps all accept without complaint. The way it works: you provide a secret message, a password, and some cover text (any normal-looking sentence or paragraph). StegCloak compresses the secret, encrypts it with AES-256 (a standard strong encryption method), and then encodes the result as a series of zero-width invisible characters woven into the cover text. The output looks exactly like the original cover text. Someone reading it in WhatsApp, Gmail, Twitter, or a webpage sees nothing unusual. The person who knows the password can run the reveal command to extract and decrypt the hidden message. You can use it in three ways: as a command-line tool you run in a terminal, as a JavaScript module you import into your own code, or through a web interface in a browser. The command-line version has options to read secrets from files, copy messages from the clipboard, and write output to a file. The API version lets developers call hide() and reveal() functions directly in their programs. The authors are upfront about what it is and is not good for. It works well for watermarking text, embedding hidden metadata, or covert communication in casual contexts where nobody is looking for hidden data. It is not designed for situations where someone is actively analyzing network traffic or scanning text for unusual unicode patterns, because an attacker examining the raw characters would notice the hidden payload even if they could not read it. The project is open source under the MIT license.