Stegstr
Stegstr was built by a contest
In August 2026 the Stegstr repository was opened to anyone who wanted to make hidden messages survive real messaging apps. One hundred and nineteen entries came in. This is how it went, who did what, and how to join in now.
How it ran
Fork the app, make the hidden data survive WhatsApp, Telegram and Instagram, keep the Nostr client working, and show your work. 119 entries; 40 with a runnable deliverable were triaged.
18 finalists, each pinned to an exact commit. Work pushed after the pin was out of scope, so every entrant was judged on the same snapshot rules.
Every runnable codec went through the same blind gauntlet: a known message, five compression profiles, three covers, decoded by the entrant's own code in a locked-down container. No hints about the channel.
Desktop entries were built from their pinned commits and run on a Linux testbench: seeded UI fuzzing across four instances, adversarial relay swarms, injection, relay drops, reconnection, and multi-user transfer.
Entry #108 by Muhammad Akif. The full record, every score and every finding, stays public on the leaderboard.
Who built what is in Stegstr today
| Contributor | Entry | In the app now |
|---|---|---|
| Muhammad Akif | #108, winner | The base of the current app: JPEG QIM encoder, the Rust CLI with JSON output and exit codes, the MCP server, channel calibration, nine upstream bug fixes including received-event signature verification, and the three-platform release pipeline. |
| Saif | #71 | The default hiding method: resize-robust STDM with locator, standard and bulk modes; the rebuilt relay layer (bounded startup, reconnection, honest sync status, per-relay publish results, de-duplication); the fix for a signer that would have leaked the secret key; the dependency-free Node CLI; the in-app window.stegstr API. |
| Shweta Dinkar | #79 | Signed (NIP-98) media uploads with the privacy cost stated in the UI; per-platform targeting profiles; the MCP-over-Node pattern. |
| Riyadh | #83 | Architecture patterns being adopted: one capability registry that generates CLI, HTTP and MCP; codec self-verification before reporting success. |
Every finalist
| Entry | GitHub | What it brought |
|---|---|---|
| #103 | bhakiya06 (source zip) | A canonical-grid codec with 100% blind survival and a clean relay publisher. |
| #101 | RohaanEhsaan | A lean Python codec with the best invisibility among the 100% survivors; audio steganography experiments. |
| #107 | Juani1972 | Per-platform codec profiles and a guided installer; 60% survival when told the channel. |
| #118 | adamouhmad10-netizen | The most distinctive UI, a Platform Safe method, a built-in reliability lab and a hardened CLI. |
| #99 | mehshmada-ctrl | QIM with Reed–Solomon; stable under fuzzing. |
| #93 | usamnang-cmyk | A standalone Rust CLI with a CRC-checked block-average codec. |
| #63 | yagame672-blip | Stego-first design that embeds fully signed Nostr events; near-invisible output. |
| #87 | jayantbhakar | A neural StegaStamp engine with a classical fallback. |
| #96 | davelab10 | Cross-platform builds and a Node CLI. |
| #82 | iftikharahmadnayyar | An agent-first design with CLI, MCP and REST surfaces. |
| #70 | david-nmc (private) | A native Android implementation with a from-scratch Schnorr signer. |
| #59 | sakibkaiser60 | A TypeScript engine with a CLI scaffold. |
| #81 | H-tech-AFAQ-CEO | A full desktop build with CI. |
| #9 | MuradAbbaszade | Signal-only payloads with multi-relay reconnect and an offline queue. |
Every measurement behind these lines, including the ones that went against an entry, is on the leaderboard, with the seeds to reproduce them.
How to take part now
Fix or improve something
Open an issue or a pull request at github.com/brunkstr/Stegstr. Every change goes through the same tests the contest used: unit tests, the blind gauntlet on three covers, and the interaction battery for anything that touches the app.
Add a hiding method
Methods are modules behind a registry. docs/codecs.md in the repository is the contract and the verification bar. A method that reads and writes correctly and survives the gauntlet ships in the app.
Maintain what you built
Contest contributors are invited to review changes to their own modules. If you were an entrant and want that role, say so in an issue.
Test on real devices
The one thing no harness can do: send images through real apps on real phones and report what came back. The test kit in the repository makes that a ten-minute job.
Build for agents
The CLI, MCP server and window.stegstr exist so that agents can use Stegstr without a person. Agent skills, integrations and write-ups are welcome.
Publicity contest
The next contest rewards bringing real people onto the Stegstr relay. Each participant gets a link and a QR code; the score is the number of new identities that arrive through it and stay active. Rules, your link, and the live scoreboard.