MS Paint Tags Your Images With a Hidden GUID

Paint and Photos stamp an invisible watermark into every saved image — even fully offline ones. Here's how to spot pixel steganography.

Dafallah Ibrahim

— 2 min read
Share

Open MS Paint, draw a rectangle, hit Save. Windows just stamped a serial number into your pixels — invisibly, and with no AI features involved. A reversing write-up on the front page of Hacker News today shows that Paint and Photos both embed a hidden GUID watermark into saved images, including ones created entirely offline.

Invisible watermarks were pitched as an AI-provenance tool. Your offline doodle was never supposed to be in scope. It now is.

Why this matters

A tool silently rewriting pixel values breaks the assumption that saving a file is a no-op. Content hashes, dedup keys, and pixel-perfect regression tests all shift when an editor decorates output on its own.

A GUID is also an identifier. If it stays stable per install, every image you export is quietly traceable back to that machine. And the technique behind it is worth knowing — most developers never touch steganography until it touches them first.

How it works

Invisible watermarks hide bits where your eyes don't look. The cheap version is least-significant-bit (LSB) steganography: flip the final bit of a color channel. A pixel that was (120, 45, 200) becomes (120, 45, 201) — a brightness change of one part in 255, invisible to humans, but now carrying one bit of payload. Spread across a few hundred pixels, that's room for a 128-bit GUID with plenty to spare.

The robust version hides bits in the frequency domain, tweaking DCT coefficients so the mark survives JPEG re-encoding and resizing. That's the family of technique behind commercial AI-image labeling systems.

Either way, the detection tell is the same: round-trip the same image through the app and diff the pixels. Deltas confined to the lowest bits mean something was written into them on purpose.

Where this helps

  • Pipeline integrity. If CI hashes images or compares renders pixel-by-pixel, know which tools mutate output on save. Ghost diffs from invisible edits waste afternoons.
  • Leak tracing. Worth stealing: watermark documents per recipient, and leaked copies point back to their source.
  • Forensics. An embedded GUID can answer "which machine produced this" long after logs are gone.
  • Privacy audits. A quick LSB check reveals what your "local-only" tools actually write into files.

Watch out

  • Behavior is version-dependent — documented on current Windows Paint and Photos builds. Re-verify on yours before making claims.
  • LSB watermarks die under JPEG re-encoding or resizing. A clean image proves nothing about its origin.
  • Photos have naturally noisy LSB planes, so visual inspection only works well on flat, synthetic images like screenshots and drawings.
  • Stripping watermarks from content you don't own can violate terms of service or law. Detect on your own files; think hard before removing.

Try it yourself

Save a flat-colored image from MS Paint, then inspect its LSB plane:

# pip install pillow numpy
from PIL import Image
import numpy as np

img = np.array(Image.open("paint_output.png").convert("RGB"))

# Isolate the least-significant bit of every channel
lsb = (img & 1) * 255
Image.fromarray(lsb.astype(np.uint8)).save("lsb_plane.png")

# Mostly uniform black = natural low bits
# Repeating patterns or structure = hidden payload

TL;DR

  • What happened: Windows Paint and Photos invisibly watermark saved images with a GUID — including fully offline, non-AI ones.
  • Why it matters: Editors now mutate pixels silently, breaking hashing, dedup, and privacy assumptions.
  • Try today: Run the LSB-plane script on something you saved from Paint.

Read more