He stored a whole web page inside a favicon. The thread had three older, cleaner ways to do it

The hack, precisely

Tim Wehrle's I Stored a Website in a Favicon does what it says: it encodes a page's HTML directly into a favicon's PNG pixel data, packing three bytes per pixel across the R, G and B channels, prefixed by a 4-byte length header so the decoder knows where the payload ends. The demo HTML was 208 bytes; with the header that's 212 bytes, needing 71 pixels, which fits in a 9×9 image at 87% of capacity. A small bootstrap loader fetches the favicon, draws it to a canvas, reads the pixels, parses the length, and renders the HTML. The author is upfront that this stores content, not a whole site — the loader is still required.

The thread one-ups it three ways

The most authoritative reply came from someone known for exactly this genre of file trickery, and it removed the loader the author thought he needed:

"You still need a tiny bootstrap loader to decode the image. Nope, you can do it all in a single file with an html/png polyglot (and nowadays you can get better compression ratios with newer formats like webp)." — David Buchanan, security researcher known for file-format polyglots

Then came the standards-based shrug — PNG already has a place to put text:

"PNG has comment chunks tEXt, zTXt, and iTXt. You can have a completely normal image whose file is stuffed with as much content as you want." — a commenter noting the built-in PNG text chunks

A simpler route still avoided pixels altogether:

"Instead of going via pixels, why not use a SVG favicon and directly store markup inside it and extract it?" — a German developer proposing an SVG favicon

And the historical deflation: this was done a quarter-century ago, with contraband:

"back in 2000, someone stored deCSS in a favicon… To extract: dd bs=1 skip=2238 < favicon.ico" — a commenter recalling the deCSS-in-favicon prior art

The fun is in the comments

The post is a pleasant micro-hack, and the thread is the better read — a small masterclass in how many ways a file format can smuggle data, from polyglots that are simultaneously valid HTML and PNG, to comment chunks built for the purpose, to SVG markup that needs no decoding at all. The 2000-era deCSS favicon is the perfect coda: people have been hiding payloads in tiny icons since favicons existed. The novelty here isn't the trick, it's that someone re-derived it from scratch and wrote it up cleanly enough to summon everyone who already knew the older, sharper versions.