End-to-end encrypted storage

ImageTome vs MEGA

MEGA has offered end-to-end encrypted storage with a large free tier for over a decade, and for a lot of people it was the first encrypted cloud they ever used. It also has the most instructive security history in this comparison, because it shows that end-to-end encryption is a property of a design, not a label.

Both encrypt in the browser. The question a 2022 research paper asked of MEGA is the question you should ask of us too: what happens if the server turns hostile?

Side by side

How ImageTome compares with MEGA
Criterion	ImageTome	MEGA
Encryption model	ImageTome End-to-end. AES-256-GCM in the browser, before upload.	MEGA End-to-end encrypted, with keys derived from your password.
Who holds the keys	ImageTome You. An RSA-4096 private key generated on your device and never sent to us.	MEGA You, derived from your password. A recovery key is issued at signup.
What an account needs	ImageTome A username. No email address, no password, no phone number.	MEGA An email address and a password.
If you lose access	ImageTome Nothing we can do. Your exported key backup is the only route back in.	MEGA The recovery key restores access. Without it, a forgotten password loses the data.
Filenames and titles	ImageTome Encrypted. Tome names, descriptions, filenames, titles and post bodies.	MEGA Filenames and folder names are encrypted.
Content scanning	ImageTome None, and none is possible. Nothing here is detected proactively, because nothing can be read.	MEGA Not possible on file contents.
Video	ImageTome MP4 and WebM up to 200MB, with thumbnails generated and encrypted in the browser.	MEGA Large files with in-browser streaming, and a generous free tier.
Sharing	ImageTome Invite by username. The tome key is wrapped with their public key.	MEGA Share links that carry the decryption key in the URL fragment, plus folder sharing.
Discussion	ImageTome Encrypted comments on posts, images and videos.	MEGA No commenting on media.
Verifying the claim	ImageTome Open your network tab during an upload and read what is actually sent.	MEGA Clients are source-available. The 2022 research made a specific, testable claim about the design.

CHECKED 30 AUG 2026 · SOURCES LISTED BELOW

What the ETH Zurich researchers found

In 2022, Matilda Backendal, Miro Haller and Kenneth Paterson at ETH Zurich published "MEGA: Malleable Encryption Goes Awry", presenting five attacks that together allowed a full compromise of the confidentiality of user files. The central one recovered a user's RSA private key by tampering with roughly 512 login attempts, something available to MEGA itself or to an adversary controlling its API infrastructure.

The important part is not that MEGA had bugs. Everyone has bugs, MEGA issued fixes, and it said it had no evidence of accounts being compromised this way. The important part is the category: the system was end-to-end encrypted and still did not protect users against a server that decided to misbehave. "End-to-end encrypted" and "safe against the operator" are not the same sentence.

The same question, asked of us

It would be dishonest to describe that research and then imply we are immune. Any browser-delivered cryptography shares the underlying exposure: the server sends the code that does the encrypting, so a server willing to send different code is a server that can hurt you. That is true of MEGA, of Proton, of Ente and of us.

What we can say about our design is narrower and checkable. Your RSA-4096 private key is generated in the browser and is never transmitted, in any form, at any point. Tome keys are AES-256-GCM and are only ever sent to us already wrapped in a member's public key. There is no login flow in which the server hands your client key material to be decrypted and returned, which is the shape of the interaction the ETH attack exploited.

The check remains the one worth doing on any of these services. Open the network tab, upload a photo, and read what actually gets sent.

Keys in links

MEGA share links put the decryption key in the URL fragment. It is a clever design, because the fragment is not sent to the server, so MEGA does not learn the key from the request. It also means the link is the key: forward it, paste it into a chat that gets indexed, or leave it in a browser history, and you have handed over the file.

ImageTome has no such link. Access is granted by wrapping the tome key with a specific member's public key, so it is bound to a person's device rather than to a string anyone can copy.

When MEGA is the better choice

MEGA's free storage tier is far larger than anything we offer, and its per-file limits are much higher than our 200MB videos.
It is general-purpose storage with desktop sync clients and mobile apps. We are a web application for shared media.
It has share links that work for recipients with no account, which our invitation model cannot do.
MEGA responded to the 2022 disclosure with fixes, and a service that has been examined by serious cryptographers and patched is in some ways a known quantity. We have not been through that.

ImageTome and MEGA, asked and answered

MEGA is end-to-end encrypted and addressed the vulnerabilities disclosed in 2022. The lasting lesson from that research is that end-to-end encryption alone does not guarantee protection against a malicious or compromised operator, which is a question worth asking of every service in this category, including ours.

ETH Zurich researchers published five attacks allowing full compromise of file confidentiality, including recovery of a user's RSA private key by tampering with around 512 login attempts. The attacks required control of MEGA's infrastructure, so they modelled a malicious server rather than an outside attacker.

Our private key is generated in the browser and never transmitted, and there is no login exchange in which the server hands back key material for the client to decrypt, which is the pattern the ETH attack abused. The general exposure of browser-delivered cryptography applies to us as it does to every service here, and we would rather say so than pretend otherwise.

The decryption key sits in the URL fragment, which is not sent to MEGA's servers, so MEGA does not see it. Anyone who obtains the full link does. ImageTome grants access by key exchange to a named member instead of by link.

Sources

Claims about MEGA were checked against the sources above on 30 August 2026. Products change. If something here is out of date or wrong, we would rather fix it than keep it.

Other comparisons

End-to-end encrypted storage

Try the version where nobody holds your key.

One username, one tome, and a look at your own network tab to check we mean it.

Create an account