Encrypted photo sharing, done properly

Encryption in transit protects your upload from anyone listening on the network. Encryption at rest protects the stored file from anyone who walks off with the disk. Both are now standard, both are worth having, and neither keeps the provider out, because the provider holds the keys.

End-to-end encryption means the photo is encrypted on your device, with a key the provider never receives, and decrypted only on the devices of people you chose. The provider stores something it cannot open. This is the meaning that changes what is possible rather than what is promised.

The practical difference shows up under pressure. A provider holding keys can be breached into readable photos, can be compelled by a court to produce readable photos, and can change its terms about what it does with readable photos. A provider holding no keys is in the same position as the attacker.

A large number of people share private photos through unlisted links, on the reasoning that nobody knows the address. The address travels in browser history, in referrer headers, in the chat app you pasted it into, and in anything that later indexes that chat. The file itself is readable by the host throughout.

Imgur illustrated the other half of the problem in 2023, when it deleted anonymous uploads that were not tied to an account and broke a great many links people had assumed were permanent. Content you do not hold the keys to lives at somebody else's discretion.

Encrypting a photo for yourself is easy. Encrypting it for a group whose membership changes is the actual problem, and it is where implementations diverge. Apple's Advanced Data Protection covers your iCloud Photos library, and iCloud Shared Albums sit outside it. The moment sharing begins, the protection ends.

The design that keeps the promise is per-recipient key wrapping. One symmetric key encrypts the content; that key is stored once per member, each copy encrypted with that member's public key. Adding somebody means wrapping the key for them, not decrypting anything on a server.

That is how a tome works. One AES-256-GCM key for the space, wrapped with each member's RSA-4096 public key, so a tome shared with eleven people is exactly as encrypted as one shared with nobody.

You lose search inside your own media, because we can only index what we can read. You lose automatic albums and memories for the same reason. You lose provider-generated previews, so thumbnails are made on your device instead. On ImageTome you also lose undelete, because there is no readable copy to hold in a trash, and you lose password recovery, because there is no password.

Ente recovers the search half of that by running face recognition and semantic search on your device rather than on a server, which is the best answer anyone has found. If searching a large library matters more to you than anything else on this page, that is where to look.

What you gain is a single, checkable property: nobody at the company can read your photos, and neither can anyone who breaches it, buys it, or compels it. That is either worth the trade or it is not, and the honest version of this page tells you both halves.

If you are moving off a mainstream service, the comparison pages set out the specifics: Google Photos and its scanning, iCloud Photos and the UK withdrawal of Advanced Data Protection, Dropbox and its server-held keys.

If you have already decided on encryption and are choosing between the services that do it properly, the Proton Drive and Ente comparisons are the useful ones, and both say where those products beat ours.