Embedding an Entire Website Inside a Favicon: What the Experiment Reveals

Favicons are tiny image files that browsers request automatically and cache for a long time, yet they are rarely inspected. Because each pixel consists of three 8‑bit colour channels, a single pixel can hold three bytes of arbitrary data.

Pixel‑Level Data Encoding

For example, the string Hi is represented by the bytes 72 and 105. By writing 72 to the red channel of a pixel and 105 to the green channel, the browser still displays a faint dark‑red dot, but the pixel now encodes the word “Hi”. This principle can be extended to embed any byte sequence, such as an entire HTML document, into an image.

Experiment: Storing a Web Page in a Favicon

The author built a simple encoder that performs three steps:

Convert the HTML payload to UTF‑8 bytes.

Prepend a 4‑byte length header so the decoder knows where the real data ends.

Write the bytes sequentially into the RGB channels of pixels (3 bytes per pixel) and save the smallest square PNG that can contain them.

The HTML payload used was:

<h1>Website in a Favicon</h1>
<p>Everything you're reading was decoded from favicon pixels.</p>
<style>body{font-family:sans-serif;background:#111;color:#0f0}</style>

Encoding results:

=== ENCODE ===
Payload (HTML): 166 bytes
+ length header: 4 bytes
Total to store: 170 bytes
Image dimensions: 8x8 px (64 pixels)
Raw capacity: 192 bytes
Utilization: 89%
PNG file on disk: 254 bytes

Decoding and Verification

Decoding the generated PNG involved loading the image, extracting pixel values, reconstructing the byte array, reading the first four bytes as the length, and then slicing the payload. The verification output was:

=== DECODE ===
Length read from header: 166 bytes
Round‑trip matches original: True

The recovered HTML matched the original byte‑for‑byte, confirming that the favicon indeed contained a functional web page.

Security Tools See Only an Image

Running the Linux file command on the PNG returned “PNG image data, 8 × 8, 8‑bit/color RGB, non‑interlaced”. Pillow also opened the file without warnings. All standard scanners treated the file as a harmless image, even though it concealed executable content.

Steganographic Implications

This technique is a classic form of steganography: data is hidden inside another data type. Because browsers allow images from many sources (the img‑src directive in CSP is far less restrictive than script‑src), an attacker can upload a malicious PNG, have a trusted script read its pixels, reconstruct the hidden payload, and execute it—all without triggering CSP or typical file‑type filters.

Practical Risk Assessment

While the favicon can act as a covert channel, it does not by itself grant code execution. An attacker must already run JavaScript capable of reading the image and decoding the payload. Thus, the favicon is not a privilege‑escalation vulnerability but a method for evading detection and exfiltrating data once a foothold exists.

Developer Recommendations

Treat any data extracted from images, audio, archives, or other seemingly benign containers as untrusted.

Prefer textContent over innerHTML when inserting decoded data into the DOM.

Do not assume a file labeled as an image is safe; MIME type and extension are declarations, not guarantees.

Be aware that img‑src in CSP can be a weak point; maintain defense‑in‑depth with input validation, content sanitization, least‑privilege policies, and runtime isolation.

Conclusion

Embedding a website in a favicon is technically feasible but offers little practical benefit for legitimate publishing due to its tiny capacity and the need for a JavaScript loader. However, the experiment highlights that favicons are one of the most overlooked files on the web yet can serve as a fully functional data container, making them attractive for covert data transport and a reminder to scrutinize even the most innocuous assets.