Steganography vs Cryptography: What Is the Difference?

The two words get used as if they were interchangeable. They are not, and the difference decides which one you need.

• Cryptography makes a message unreadable. Everyone can see there is a secret; nobody without the key can read it.
• Steganography makes a message unnoticed. Nobody sees a secret at all — just a photo, a song, a document.

One is a safe. The other is a safe nobody knows is in the room.

Cryptography: the locked box

Encryption takes your text and a key and produces ciphertext: data that is statistically indistinguishable from noise. With a modern algorithm such as AES-256 and a properly derived key, the only realistic attacks are on the key — a weak password, a compromised device, a person who can be pressured.

What encryption does not do is hide that it happened. A file called wallet.enc, a message that starts with -----BEGIN PGP MESSAGE-----, a disk that is pure random bytes: each one says, clearly, there is something here worth protecting. For most people that is fine. For some it is the whole problem — a border crossing, a shared computer, a burglar who takes the labelled USB stick and leaves the photo album.

Steganography: the box nobody sees

Steganography puts the data inside a carrier that has an innocent reason to exist. In an image, the usual method is to write into the least significant bits of the pixel values: changing a colour from 182 to 183 is invisible to any eye, and a single photo has room for a surprising amount of data.

On its own, that is weak. If someone suspects the image and knows the method, they extract the hidden bytes and read them. Hiding is not locking.

Why real tools do both

The sensible order is encrypt, then hide:

1. Your secret is encrypted — it is now ciphertext, unreadable without the key.
2. The ciphertext is written into the image.

This gives you two independent protections, and a useful side effect: ciphertext looks like random noise, and random noise in the lowest bits of an image looks like a camera sensor. Hidden plain text has structure that statistical tests can pick up; hidden ciphertext does not.

This is how StegoSafe works: AES-256-GCM with a key stretched from your passphrase, then embedded in the pixels with no header, marker or signature — so a wrong password, an ordinary photo and a damaged file all fail in exactly the same way. There is nothing for a scanner to match on. (Scoped honestly: that covers a scanner and a person going through a photo library. A forensic lab running statistical steganalysis is a stronger adversary, and no consumer steganography should be sold as beating one.) The full walkthrough is in What Happens When You Hide a Secret in a Photo.

Side by side

When each one is the wrong tool

Steganography alone is wrong for anything that matters. Always encrypt first.

Steganography at all is wrong when the carrier will be modified. Messengers recompress photos, which destroys pixel-level data — more on that, and on the alternative, in How to Hide Text in an Image: Two Ways.

Encryption alone is wrong when the existence of the secret is itself the risk, or when you want the backup to be something nobody would think to steal.

Neither helps against a compromised device. If malware is reading your screen, the mathematics is irrelevant.

A practical example

You need to keep a 24-word wallet recovery phrase for ten years.

• Written on paper: readable by anyone who finds it.
• Encrypted in a file called seed.txt.gpg: safe, and labelled as treasure.
• Encrypted and hidden in three of the two thousand photos in your library, split so that any two recover it: safe, unlabelled, and survivable if you lose one. That is the case Five Photos, Any Three walks through.

Cryptography decides who can read it. Steganography decides who goes looking. Use the first always, and the second when not being looked for is worth something to you.

One question follows naturally from that, and it deserves an honest answer rather than a slogan: is plausible deniability legal?