Guide
Encrypted video sharing, and why it is rare
There are plenty of encrypted photo services and almost no encrypted video ones. The reason is not that video is harder to encrypt. It is that everything people expect from video requires a server that can watch it.
Streaming is the thing that gives it away
When a video starts playing before it has downloaded, a server has chopped it into segments and is handing them over one at a time. When it drops to a lower resolution on a bad connection, a server has produced several versions of it. When captions appear, a server has listened to the audio. Every one of those requires the file to be readable where it is stored.
That is why the video platforms people use are not end-to-end encrypted and do not claim to be. It is not negligence, it is the price of adaptive streaming, and for public video it is a price worth paying.
For private video it is not. ImageTome downloads the encrypted file to your device, unwraps the tome key with your private key, and decrypts and plays it there. You wait a moment longer for it to start, and no server anywhere has seen a frame.
The thumbnail problem, and how it is solved
A gallery of videos needs poster frames, and a poster frame is normally produced by a server opening the video and grabbing an image. That single convenience breaks the whole model, because a server that can grab frame one can grab all of them.
On ImageTome the thumbnail is captured in your browser from the video you already hold in the clear, then encrypted with the tome key like everything else. Browsing a tome decrypts small encrypted thumbnails rather than requesting readable ones from us. The gallery works, and the compromise that normally makes it work is not there.
What the alternatives actually offer
WeTransfer moves large videos easily, holds the keys, expires the file in a few days, and in July 2025 briefly granted itself a licence to train machine learning models on uploaded content before reversing it after public objection. A licence over your files is only meaningful if the files can be read.
Dropbox and MEGA both take much larger videos than we do. Dropbox holds the keys; MEGA does not, and was shown in 2022 by ETH Zurich researchers to have a design that did not protect users against its own server, which it then fixed.
YouTube and Vimeo unlisted links are not privacy. They are addresses that are not indexed, on platforms that can watch the video and enforce policy against it.
What you get
MP4, WebM and QuickTime
The formats a phone or a camera actually produces, encrypted with AES-256-GCM in the browser before any of it is uploaded.
200MB per video
Smaller than a general file host allows, and enough for the clips people actually share. Photos are up to 50MB each, 25 per post.
Thumbnails made on your device
The poster frame is captured in your browser from the decrypted video and encrypted before upload, so a gallery can be browsed without us ever seeing a frame.
Decrypted for playback in the browser
Your device fetches the ciphertext, unwraps the tome key with your private key and plays the result. Nothing is decrypted on a server.
Encrypted filenames and titles
A video called "hospital appointment" gives away most of what it contains. The name is encrypted along with the file.
Encrypted comments underneath
Discussion about a video is as protected as the video, under the same tome key.
The honest limit: 200MB per video is smaller than a general file host, there is no transcoding, no captions and no adaptive streaming, and there never will be, because each of them needs a server that can watch your video.
Compared with
vs WeTransfer
WeTransfer is a delivery van with a window. We are a locked box that only the recipient has a key for.
Mainstream cloud storagevs Dropbox
Dropbox encrypts the disk. We encrypt the file, in your browser, with a key Dropbox's architecture has no equivalent of.
End-to-end encrypted storagevs MEGA
Both encrypt in the browser. The question a 2022 research paper asked of MEGA is the question you should ask of us too: what happens if the server turns hostile?
Encrypted video, asked and answered
Yes, if you accept downloading the file before playing it rather than streaming it. Streaming requires a server that can read the video to segment and transcode it, which is why almost every video platform holds the keys. ImageTome downloads the encrypted file and decrypts it in your browser.
Because their best features need to read the file: transcoding to multiple resolutions, adaptive streaming, automatic captions, thumbnails and content moderation. A server that cannot open the video cannot do any of them.
200MB per video, in MP4, WebM or QuickTime. General file hosts like Dropbox and MEGA allow far larger files, and they hold the keys to them.
No. Unlisted means it is not in search results. The platform can read and analyse the video, the link works for anyone who has it, and the video is subject to content policy enforcement that requires watching it.
Invite them to a tome containing it, which wraps the tome key with their public key so only their device can unwrap it. For a recipient who will not create an account, an end-to-end encrypted messenger like Signal is the more practical route.
No. Both require processing the audio on a server, which would mean the server could hear the video. This is a real feature we do not have and cannot add without breaking the design.
Share the video with eleven people and nobody else.
Encrypted in the browser, thumbnailed on your device, played back without a server ever seeing a frame.
Create an account