Hiding video inside a single JPEG by abusing progressive scans

Progressive JPEGs split their compressed data into sequential “scans,” each declaring its own spectral (DCT) range so a partially downloaded image renders as a coarse preview that sharpens as more data arrives. Because every scan explicitly states which frequency bins it covers, a crafted file can have later scans overwrite already-rendered pixels rather than merely refine them. Concatenating several same-resolution images—stripped of their start-of-image, start-of-frame, and end-of-image markers—produces one file that visibly cycles through multiple pictures when delivered over a slow connection.

The catch is that decoders cap how many scans they’ll process, apparently as a zip-bomb safeguard, which limits the naive approach to about nine frames. The workaround is to minimize scans per frame. Baseline single-scan JPEGs don’t work because baseline decoders stop after the first scan, and progressive mode forbids mixing DC and AC data in one scan. That leaves the smallest viable unit: a single DC-only scan, a fully standards-compliant image rendered at 1/16 resolution. Stacking these, the author gets Chrome to play roughly 90 frames (Firefox tolerates more), enough to embed a whole video—Bad Apple, naturally—in one image, and it sidesteps the ghosting the concatenation trick otherwise produced.

There’s no real utility here: JPEG carries no timing metadata, so playback speed is entirely at the mercy of network latency. The value is the demonstration itself—pure-HTML “video” using