# SteganographierGUI: hiding an archive inside an MP4 or MKV file

> SteganographierGUI is a MIT-licensed Python tool that packs a file or folder into a ZIP archive and appends it to a video file, so the result plays as ordinary video and yields the archive when the extension is changed. It is obfuscation rather than encryption, and version 1.3.10 was withdrawn by its author because of real bugs.

**cenglin123/SteganographierGUI** — 将文件隐写进MP4/MKV文件中 （Embed files into MP4/MKV files.）

- Repository: https://github.com/cenglin123/SteganographierGUI
- Stars: 1,008 · Forks: 52
- Language: Python
- License: MIT
- Published: 2026-10-20 · Updated: 2026-10-20 · Language: en
- Canonical page: https://hysenlabs.com/projects/cenglin123-steganographiergui

## Why a ZIP is appended to a video instead of a picture

The core trick is old and the project says so: the traditional approach appends an archive to an image, for example copy /b "图片.jpg" + "压缩包.zip" "生成目标.jpg", which produces a file that opens as a picture and unzips after a rename. The author rejected the image version on suspicion grounds, arguing that a several gigabyte file that is also a low resolution picture invites questions from anyone who looks at a sharing page, while a large video does not. So the shell is a normal MP4 or MKV video, and the payload is a ZIP archive appended to the MP4 or attached in the MKV. Opened as a video, the file shows only video. Renamed to.zip, an extractor finds the archive and unpacks it. The project's stated motivation is file sharing through cloud drives that reject or take down links, and it argues the disguise lowers suspicion at the lowest cost. That is a design goal about plausibility, not about cryptography, and the difference matters for everything that follows.

## The command line: -i, -o, -p, -t, -c and -r

Two front ends exist. The GUI is the recommended one: double click the program, drag a file in, and steganograph or extract with one click. The CLI takes the same operations as arguments, which is what you want for batch work or for calling the program from another tool. The flags are -i for the input file or folder, -o for the output file name including the extension or for the output directory, -p for a password, -t for the output container type where mp4 and mkv are supported, -c for the outer video, and -r to run extraction instead. Hiding a file with an explicit cover video and output name looks like this:

```python
python Steganographier.py -i "input.txt" -o "output.mp4" -p "password" -t "mp4" -c "cover.mp4"
```

A folder works as input, and extraction reverses the operation:

```python
python Steganographier.py -i "inputFolder" -o "output.mp4" -p "password" -t "mp4"
```

```python
python Steganographier.py -i "input.mp4" -r -p "password"
```

With no arguments beyond the input, defaults apply:

```python
python Steganographier.py "input.txt"
```

Output naming follows a fixed rule. With no output path the file is created next to the input, named after the input plus _hidden.mp4 or _hidden.mkv. If you give a directory but no file name, the same default name is used inside it. If no cover video is supplied, the program looks in three places in order: the cover_video folder next to the program, the program directory itself, and the parent directory of the input.

## Extraction depends on the archive tool, not on the program

A property the project stresses is that the output does not need this program to be read. Any extractor can open it, provided the file is renamed to .zip, so the tool is not a lock-in format. WinRAR is the recommended path, and the documentation repeats that renaming the MP4 to .zip and extracting with WinRAR is the supported route, with WinRAR 6 suggested. 7-zip and Bandizip can open it in hash mode, or be used from the command line. On phones, Android users open it with RAR and iOS users with a zip utility. One exception shows up in version 1.3.1, which added a new work mode called mp4(zarchiver). Archives written in that mode can be unpacked by zarchiver and by tools that scan for the archive from the start of the file, but not by WinRAR, which scans compressed archives from the end. That single difference decides which extractor a recipient needs, and the README explains it so recipients can be told in advance.

## The password book, the hash changer and the code image

Three auxiliary features surround the core function. The password book is a plain text file at modules/PW.txt where you write one password per line, and the program then tries each stored password when it extracts, matching automatically so you do not have to type it in. The hash changer is intended for the moment before a file is uploaded to a cloud drive: altering the file hash so that a link which was taken down does not match the same file again. The code image generator turns an extraction code into an image, so the code is not sitting in plain text where a crawler could read it. The context menu integration adds entries to the Windows right-click menu, so hiding or extracting a file works the way an archive tool does. Taken together these show where the project sits: it is built around sharing files through services that police uploads, and each helper exists because of a specific friction point in that workflow.

## The 1.3.10 release the author withdrew, and what 1.3.11 changed

The changelog is unusually candid, and it is worth reading before installing anything. Version 1.3.10, released on 2026-08-18, is marked as having serious problems and as an intermediate product of a restructuring, with a recommendation not to use it. Two concrete defects are named: the right-click menu could not register on any install path, erroring outright when the path contained a space and silently writing a wrong value when it did not, and the CLI, when the input path ended with a directory separator, would write a self-contained archive into itself, growing the file without bound and hanging. Version 1.3.11, released on 2026-09-20, fixes both, with the context menu registry writing rewritten to stop passing arguments through the command line and verified on paths containing spaces, Chinese characters, and the characters &, ! and ^. It also restores the installer look and wording from 1.3.9, adds Simplified Chinese and English chosen by system language, stops upgrades and reinstalls from overwriting modules\PW.txt, config.json and the logs directory, and silences the silent install. Upgrading over 1.3.10 with the new version is enough, and your user data survives.

## Build, packaging and the vendored directory layout

The repository holds Steganographier.py as the main script, a PyInstaller spec file named SteganographierGUI.spec, a VERSION file, and directories for the installer, the context menu implementation, the cover_video folder, modules, tools, docs and vendor. Starting with 1.3.10 the release packages are built by GitHub Actions and ship with a SHA256SUMS file for verification, and the official package no longer bundles DownKyi, a Bilibili download tool, so anyone who wants it has to fetch it separately. The 1.3.11 release also tidied the package layout: the runtime moved into _internal, the context menu implementation into context-menu, and the release root shrank from ten directories and 73 files to six directories and 8 files. The runtime dependencies are pinned in requirements.txt, and they say a lot about the implementation: hachoir for parsing media metadata, natsort for natural ordering, pycryptodomex and pyzipper for the encrypted archive side, psutil for process and file handling, and tkinterdnd2 for drag and drop in the GUI. The one dependency change users noticed in 1.3.10 is that the CLI no longer depends on Tkinter, so the command line works on a headless machine with no GUI libraries installed.

## What this tool is and is not

Be precise about the security properties. The payload is an ordinary ZIP archive appended to a video, so anyone with the file can find the archive, and the password protects the archive contents rather than the hiding. This is obfuscation with a plausible cover, not steganography in the signal processing sense and not encryption, and the project says so plainly when it explains the goal as lowering how suspicious the file looks. The hash changer works the same way: it is a workaround for a sharing service that identifies files by hash, not a defence against anyone who has the file. The whole design also assumes the environment the author describes, cloud drives in China that police uploads, take down links and process mass reports, and a need to move files that those services reject. Outside that setting the archive is still portable, but the motivation largely disappears. On licensing, the project is MIT, so the code can be read, modified and redistributed under those terms, and the last push was on 2026-10-11, with tagged releases up to 1.3.11 and a CHANGELOG.md in the tree.

## Conclusion

SteganographierGUI is worth a try if you need to move a file through a channel that rejects archives, and you accept that the hiding is a disguise rather than a security guarantee: the archive is appended in the clear and anyone who renames the file gets it. It is the wrong tool when you need confidentiality, since the only protection is the archive password. Use version 1.3.11 or later rather than 1.3.10, install from the release package, and keep your own copy of the archive in case the appended payload is lost when the video is re-encoded.

## FAQ

### How do I extract a file hidden with SteganographierGUI?

Rename the MP4 or MKV to .zip and extract it with an archive tool, WinRAR being the recommended one. 7-zip and Bandizip can open the file in hash mode, and the built-in CLI can also extract with python Steganographier.py -i "input.mp4" -r -p "password".

### Which version of SteganographierGUI should I install?

Version 1.3.11 or later. The author marks 1.3.10 as having serious problems, including a right-click menu that could not register and a CLI that could hang when the input path ended with a directory separator.

### Does the hiding keep my files secret?

No. The archive is appended to the video and can be recovered by anyone who renames the file, so the password protects the archive contents while the hiding itself is only a disguise. Any tool that renames to .zip can extract the payload.

### Where does SteganographierGUI look for the cover video?

When no cover video is given, it searches the cover_video folder next to the program, then the program directory itself, and finally the parent directory of the input file or folder.

## Sources

- [cenglin123/SteganographierGUI on GitHub](https://github.com/cenglin123/SteganographierGUI)
- [Issues](https://github.com/cenglin123/SteganographierGUI/issues)
- [License: MIT](https://github.com/cenglin123/SteganographierGUI/blob/main/LICENSE)
- [README](https://github.com/cenglin123/SteganographierGUI/blob/main/README.md)
- [Releases](https://github.com/cenglin123/SteganographierGUI/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/cenglin123-steganographiergui