Stage 1 · Binary (Base 2)

A computer only understands two states: off (0) and on (1). Every photo, every email, every video on a phone is built from those two values. A single 0 or 1 is called a bit. Eight bits in a row is called a byte.

The trick to reading binary: each position in the byte has a place value, the same way base-10 has a ones place, tens place, hundreds place. In binary the place values are powers of two: 128, 64, 32, 16, 8, 4, 2, 1. Add up the place values where the bit is on, and that is the number the byte represents.

Demo Cue Click the bit switches below. Start by lighting up only the rightmost bit, then only the next one. Watch the decimal value climb: 1, 2, 4, 8, 16, 32, 64, 128. Each bit position is worth double the one to its right.
Binary
0000 0000
Decimal
0

Try a challenge

Convert the decimal number below into eight binary digits, then submit your answer to check it. The bit switches above are there if you want to count along; the place values are 128, 64, 32, 16, 8, 4, 2, 1.

Challenge 1 of 4
Convert this decimal value to binary
5

Enter exactly eight 0s and 1s. One space between the two nibbles is allowed (for example, 0000 0101). Press Enter or click Submit.

Stage 2 · Hexadecimal (Base 16)

Binary is honest, but it is long. Writing eight 1s and 0s for every byte is exhausting. Forensic tools, network packets, and memory dumps almost always use hex instead. Hex is base 16, which means it has sixteen digits: 0 1 2 3 4 5 6 7 8 9 A B C D E F. The letters A through F represent the numbers 10 through 15.

The clever part: four bits convert into exactly one hex digit. A group of four bits is called a nibble. Split a byte down the middle into two nibbles, convert each nibble, and the byte becomes two hex characters.

Why It Matters When a forensic examiner opens a disk image in a hex editor, they are looking at billions of bytes shown as hex. A file that starts with FF D8 FF is a JPEG photo. A file that starts with 25 50 44 46 is a PDF. Recognizing those signatures is how examiners identify files even when the filename has been changed.

Nibble → Hex reference

BinaryDecimalHex BinaryDecimalHex

Watch the conversion happen

Toggle the bits below. The two nibbles convert into hex independently, then combine into one byte.

Upper Nibble
0
Lower Nibble
0
Binary Byte
0000 0000
Hex Byte
0x00
Decimal
0

Stage 3 · ASCII (Numbers Become Letters)

Computers do not actually have a concept of the letter A. They only have numbers. To handle text, computers use a lookup table called ASCII (American Standard Code for Information Interchange). Each character is assigned a number from 0 to 127. The capital letter A is decimal 65, hex 0x41, binary 01000001. The capital letter B is 66, 0x42. The lowercase a is 97, 0x61.

Demo Cue Type a single letter, number, or symbol below. The page will show its decimal, hex, and binary representation in real time. Then point at the matching cell in the ASCII reference table, which will highlight as you type.

Pick any printable character. The lookup highlights below.

Character
A
Decimal
65
Hex
0x41
Binary
01000001

ASCII reference (printable characters, 32 to 126)

Stage 4 · The Full Chain

Now stitch the three steps together. A short word becomes a row of bytes. Each byte can be written in three equivalent ways: binary, hex, or as the ASCII character it represents. A forensic analyst can read any of these representations and reach the same answer.

Connect The Dots Investigators recover deleted text fragments from disk this way every day. The raw drive returns a stream of bytes. The analyst converts the bytes to ASCII, recognizes the readable text, and reconstructs a deleted document, chat message, or email.
Character Decimal Hex Binary (one byte)

Stage 5 · Steganography: Hiding a Message in a Picture

Every pixel in a digital image stores three numbers: a Red value, a Green value, and a Blue value, each from 0 to 255. That is one byte per color, three bytes per pixel. The rightmost bit of each byte is called the least significant bit, or LSB. Changing the LSB shifts the color value by exactly 1 out of 256, which the human eye almost never notices.

Steganography exploits that fact. An attacker (or a journalist protecting a source) can take a normal-looking photo, walk through each pixel, and overwrite the LSB of each color channel with one bit of a hidden message. The picture still looks identical. The message is in there, one bit at a time, waiting for someone with the right tool to extract it.

Demo Cue Type a short message in the box. Click Encode. The original image and the steganographic image will look the same to the eye, but the pixel table will show exactly which bits flipped.

Original Image

Stego Image (LSB-encoded)

Both canvases are scaled up so the pixel grid is visible. The two images look identical. The differences are smaller than the eye can detect.

What actually changed in the first 9 pixels

Pixel Channel Original (binary) Stego (binary) Hidden bit

highlighted rows show channels where the LSB was flipped. Unhighlighted rows already had the correct LSB and did not need to change.

Career Connection Detecting steganography is part of a real forensic specialty called steganalysis. Federal investigators, military analysts, and corporate security teams all use these techniques. Hidden messages have shown up in real cases involving espionage, intellectual property theft, and command-and-control traffic for malware. The math you just used is the math the professionals use.