I Stored a Website in a Favicon

theanonymousone 298 points 103 comments June 20, 2026

Discussion Highlights (19 comments)

superjose

Pretty cool tbh!!! Would have loved seeing the decoder code!!! It's also pretty interesting to think how an attacker could exploit images on his behalf. Never thought that would be a way!!! Thanks!

franciscop

Is this timing coincidence? I just submitted 1h (30 mins before this) ago a website I just made about storing your stock porfolio in a URL + favicon! https://news.ycombinator.com/item?id=48606396

sheept

You can use the favicon cache as storage too, by redirecting users across domains. It's been proposed as a potential fingerprinting risk[0], and if a browser naively reuses the cache for incognito mode, it could be used to track users across browser profiles. [0]: https://www.schneier.com/blog/archives/2021/02/browser-track...

Tepix

Instead of going via pixels, why not use a SVG favicon and directly store markup inside it and extract it? Use this favicon.svg: <svg xmlns="http://www.w3.org/2000/svg"> <circle cx="50%" cy="50%" r="50%" fill="orange"/> <p>hello HN!</p> </svg> use this in your <head> to use a svg favicon: <link id="favicon" rel="icon" href="favicon.svg" type="image/svg+xml"> finally, use this in your <body> to extract it and add it to your document body: <script> fetch(favicon.href).then(r => r.text()).then(t => document.body.innerHTML += t.match(/<p[\s\S]*p>/)[0]); </script>

bozdemir

Very cool. I wonder is it possible to make a simple game with also leveraging the webassembly?

Walf

PNG has comment chunks tEXt, zTXt, and iTXt. You can have a completely normal image whose file is stuffed with as much content as you want. That is less fun, I suppose.

beardyw

I would have used a minimal service worker to unpack the web data and present it as if it were just a normal page being loaded.

fitsumbelay

very cool and interesting after reading just the title I wrongly assumed this would be about svg

jibal

Surprised that a minimal "website" only requires a small image = few pixels = few bytes to store it? Um, ok.

ab_wahab01

Fascinating concept! Thanks for sharing this!

esquivalience

I found the agressively staccato, clearly LLM-generated content extremely difficult to read.

scoot

Would have been more fun if the blogpost was rendered from the favicon.

soanvig

Honestly it didn't interest me, but I do remember from back in the days full websites rendered by a browser from... Empty files. https://mathiasbynens.be/notes/css-without-html

neon_me

Is it cake? Game for devs.

berkes

I'd imagine the (aggressive) caching of the favicon by browsers makes it a challenge, but you could generate the favicon dynamically, then have JS extract the sequentially. Basically streaming arbitraily large content to a webpage via favicons. Via blocks of 239 bytes. It may be a fun, novel way to proxy webpages that are otherwise blocked. Though, i guess, the service rendering the favicons can just as easily be blocked then.

tetrisgm

Love it. Did you see the old effort to store the page in the url? https://github.com/jstrieb/urlpages

jorisw

Fun Fact: You can use any inline SVG for a favicon and keep it right in the HTML document. This also allows you to use an emoji directly as a favicon, like so: <link rel="icon" type="image/svg+xml" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>(your emoji here)</text></svg>" /> (HN isn't showing the emoji)

Izmaki

Wait 'til the author discovers that you can use ping (ICMP) to transfer data, too! :)

charcircuit

You can literally just use the file itself as the favicon. There is no need to over complicate it. cp index.html favicon.png

I Stored a Website in a Favicon

Discussion Highlights (19 comments)

Related Discussions