How does whitespace steganography work?

Each character of the secret message is turned into 8 bits. A bit value of 0 is written as a space and a bit value of 1 as a tab. These whitespace characters are appended to the cover text where they are invisible in most editors.

Why use spaces and tabs instead of zero-width characters?

Spaces and tabs are ordinary ASCII whitespace that survives copy-paste through plain-text channels, code comments and many chat apps where exotic Unicode might be stripped. They are invisible at the end of a line.

Is the hidden data encrypted?

No. Steganography hides the existence of a message, it does not encrypt it. Anyone who knows the space/tab scheme can decode it, so combine it with real encryption if you need secrecy rather than just concealment.

Will the whitespace survive everywhere?

Often, but not always. Many editors, linters and chat platforms trim trailing whitespace automatically, which would destroy the hidden payload. Test your channel before relying on it.

What characters can I hide?

This encoder uses 8 bits per character, covering standard ASCII. For full Unicode, encode your secret as UTF-8 first; the tool handles each code unit up to 8 bits and warns if a character is out of range.

What is the Whitespace Steganography Encoder?

Hide a secret message inside invisible trailing whitespace, encoding each byte as a pattern of spaces (bit 0) and tabs (bit 1). Decode any whitespace-tagged text back to the hidden message. It runs free in your browser on Gera Tools, with nothing uploaded.

Whitespace Steganography Encoder

Name: Whitespace Steganography Encoder
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

What this tool does

This is a whitespace steganography encoder and decoder. It conceals a secret message inside a block of trailing spaces and tabs that is invisible when the text is displayed normally. The visible “cover” text looks ordinary; the secret rides along in the whitespace after it.

How it works

Encoding is a straightforward binary mapping:

Each character of the secret is converted to its 8-bit binary value.
Each bit becomes a whitespace character: 0 → space, 1 → tab.
The resulting run of spaces and tabs is appended to your cover text.

Because trailing spaces and tabs render as empty space, the message hides in plain sight. Decoding reverses it: the tool scans the trailing whitespace, reads each space as 0 and each tab as 1, regroups the bits into bytes, and reconstructs the characters.

Worked example — encoding the word “Hi”

H in binary is 01001000. i in binary is 01101001.

Encoding both:

H: 0 1 0 0 1 0 0 0
   ␣ ⇥ ␣ ␣ ⇥ ␣ ␣ ␣   (8 whitespace characters)

i: 0 1 1 0 1 0 0 1
   ␣ ⇥ ⇥ ␣ ⇥ ␣ ␣ ⇥   (8 whitespace characters)

The cover text “Hello world” followed by 16 invisible whitespace characters looks exactly like “Hello world” in any text renderer, but the decoder extracts “Hi” from the trailing whitespace.

Steganography vs. encryption — an important distinction

Steganography and encryption are different tools:

Property	Steganography	Encryption
Hides the existence of a message	Yes	No
Hides the content of a message	No (without combining with encryption)	Yes
Requires a key to read	No (scheme itself is the “key”)	Yes
Survives inspection of the carrier	Only if the scheme is unknown	Yes

Whitespace steganography is designed for concealment — a casual reader sees nothing. But anyone who knows to look for a space/tab encoding can decode it instantly. If you need both concealment and confidentiality, encrypt the secret first, then encode the ciphertext with this tool.

When whitespace survives — and when it doesn’t

This encoding is fragile in practice. Trailing whitespace is the first thing many systems strip:

Most code editors (VS Code, Vim, Sublime) trim trailing whitespace on save by default.
Git’s --whitespace=fix option and many pre-commit hooks strip it.
Email clients and webmail normalise whitespace.
Messaging apps (Slack, WhatsApp, Signal) discard trailing spaces.
Plain-text pastebins often strip or normalise whitespace.

Channels where it tends to survive: certain file hosting services, raw file downloads, some databases storing text as-is, and direct file transfers where no application processes the content.

Always test your channel by encoding a short message, transferring it through the intended medium, and decoding on the other end before relying on it.

Practical notes

This encoder uses 8 bits per character, covering standard ASCII (0–127). Extended ASCII (128–255) also works but may behave differently on different systems.
For Unicode secrets, the tool handles each byte of the UTF-8 encoding separately, which works correctly for any Unicode text as long as both encoder and decoder agree on UTF-8.
The payload is not length-delimited in the cover text, so the decoder must receive the full encoded text intact to reconstruct it correctly.