A German developer turned a 9×9 pixel PNG into a 208‑byte HTML payload, proving a favicon can double as a micro‑website. By encoding UTF‑8 text into RGB channels, the tiny image carries the page’s markup and a bootstrap script.

The trick relies on the browser’s canvas API. After loading the favicon, JavaScript reads each pixel, rebuilds the byte array, and decodes the HTML. The result is a page that replaces itself with content extracted from its own icon.

Although the capacity is limited—only 239 bytes total—the experiment showcases the limits of steganography in web assets. It also highlights how browsers expose raw image data, offering a niche vector for data hiding.

The project demonstrates that even the smallest web asset can host executable content, a finding useful for security researchers testing browser parsing limits.