u/okaylevi

I got into steganography by building games in PICO-8 and studying how it packs data into the virtual cartridges. That sent me down a rabbit hole: could this same concept power a full content management system?

Over the last year or so I have been building Minilith, an experimental tool that takes an entire JSON state (posts, pages, site settings), compresses it, and embeds it into a 256x256 PNG to act as a portable DB.

The architecture is completely client side and zero-dependency. There is no backend or build step, and it relies entirely on native browser APIs to extract and render the site directly from the image.

The Encoding Process:

1. The payload is deflated and injected into the image's RGB channels using 3-3-2 LSB encoding I chose this to increase the storage and maintain the image size. Minilith gives a hard limit of 64KB of compressed data, an intentional constraint which allows for nearly 200KB of uncompressed data which is a ton of text and perfect way to keep a micro blog micro!
2. To ensure the image is executable, I inject a raw tEXt chunk containing a vanilla JS extraction script right before the IEND marker. This turns the image into a polyglot.
3. Before the payload is allowed to decompress and run, a visual fingerprint (SHA-256) and a cryptographic signature are verified client side.

The flaw as expected is aggressive image optimization destroying the payload. I actually view this as a feature to keep the content secure from unwanted distribution. (Though funny enough, sending the raw image over iMessage keeps the payload intact).

Read more on the process here: Can a PNG Be a Database? The Architecture of Minilith

Has anyone else messed around with executable image polyglots for practical data storage? Would love to hear about similar projects.