stegsnow

stegsnow (the SNOW scheme by Matthew Kwan) hides data in the trailing whitespace of text — appending spaces and tabs at the end of lines, where they are invisible in almost every viewer. It encodes roughly three bits per eight columns and can optionally compress and password-protect the payload.

Revealing whitespace first

Before extracting, confirm there is hidden whitespace:

$ cat -A file.txt        # spaces stay blank, tabs show as ^I, line ends as $
$ wc -c file.txt         # compare to the visible character count

Trailing ^I/spaces before each $ are the tell.

Extracting

$ stegsnow -C file.txt                 # extract (auto-decompress), no password
$ stegsnow -p 'secret' -C file.txt     # extract with a password

Hiding (for building challenges / testing)

$ stegsnow -C -m "hidden message" -p "secret" cover.txt out.txt

-m is the message, -C enables compression, -p sets the password.

Installing locally

$ sudo apt install stegsnow        # Kali/Debian; part of the "snow" package

Limitations

• Works on text carriers only. For zero-width Unicode or homoglyph hiding, see the Text & Unicode techniques.
• Editors that strip trailing whitespace on save will destroy the payload — always work on an untouched copy.

Common CTF patterns

• A .txt whose wc -c far exceeds its visible length → stegsnow -C.
• Whitespace stego is easy to miss; add cat -A to your standard text checklist.
• Overlaps with the Whitespace esolang — if cat -A shows only spaces/tabs/newlines, consider both.