Accounts
No email. No password. Just a username.
Every other service on our comparison pages wants an email address, and most want a password with it. Proton, Ente, MEGA, Tresorit, Google and Apple all do. We ask for a username, and this page explains both why and what it costs.
The keypair is the account
When you register, your browser uses the Web Crypto API to generate an RSA-4096 keypair. The public half is uploaded so other people can wrap tome keys for you. The private half stays on your device and is never transmitted.
Signing in means proving you hold that private key, not typing a secret we can compare against a stored hash. There is nothing on our side that could be replayed, cracked offline or dumped in a breach, because there is no credential on our side at all.
Why an email address is not a neutral request
An email address is a join key. It is the identifier that lets one dataset be matched to another, which is precisely why data brokers collect them and why breach dumps are searchable by them. Attaching one to a photo library links that library to everything else the same address has signed up for.
It is also the route through which account takeovers usually run. Compromise the inbox and you can reset the password on almost everything the address touches. A service with no email address and no password reset has closed that path entirely.
None of that makes email-based accounts wrong. They exist because recovery, support and communication are genuinely useful. It makes them a trade, and it is a trade most services make on your behalf without mentioning it.
The cost, which is smaller than it was
This page used to say there was no way back in at all, and pointed you at Proton's recovery phrase or Ente's recovery key as better answers. That was true and it cost people their accounts for no better reason than a cleared browser, so we built a way back in.
It works the way the rest of this does. Switch recovery on and your browser seals a copy of your private key under a six-word passphrase we generate and a numeric passcode, then uploads only the sealed result. Getting back in means proving the passcode to us so we hand the sealed copy over, then opening it in your browser with the passphrase. We never receive the passphrase and cannot open what we store.
There is still no reset link and no support ticket that restores access, because there is still nothing on our side to reset. Forget the passphrase and the sealed copy is as shut to you as it is to us. And enabling it does mean a copy of your key sits on our servers where none was before - safe against a stolen database, and resting on your passphrase against anything worse. Our security audit spells that out.
So: switch on recovery, or export your key backup, on the day you sign up. Either takes seconds and either is the difference between a lost laptop and a lost archive. Doing neither is the one situation nobody can rescue.
What we do not ask for, and what that costs
No email address
There is no field for one. Nothing links your tomes to an inbox, a marketing list, a data broker's join key or a breach dump.
No password
Nothing to phish, nothing to reuse from another site, and no password database to be stolen, because there are no passwords stored anywhere.
No phone number
No SMS verification, so no SIM swap risk and no phone number sitting next to your photographs in a database.
No tracking
No analytics scripts and no advertising identifiers. Fonts are served from Bunny rather than Google, so loading the page does not tell Google you were here.
No recovery inbox
There is no reset link, because there is nowhere to send one. Recovery, if you switch it on, runs on a passphrase you hold rather than a mailbox somebody else can compromise.
No moderation queue
We cannot read your content, so we cannot review it. Nobody deletes your photos over a policy change, and nobody can check them for anything either.
Services that want your email address
vs Proton Drive
Proton is a general encrypted drive with an account you can recover through email or a phrase. We are an encrypted media space where recovery is optional and depends on secrets only you hold.
End-to-end encrypted photosvs Ente Photos
Ente is an encrypted photo library with on-device intelligence. We are an encrypted shared space with no email address and discussion built in.
Mainstream cloud photosvs Google Photos
Google encrypts your photos and keeps the keys. We encrypt your photos and never have the keys.
Accounts without an email, asked and answered
Yes. Registration on ImageTome generates an RSA-4096 keypair in your browser and asks you to choose a username. There is no email field, no password field and no phone number. The keypair is the account.
Two ways. Export your private key from the first device and import it on the second, which is the manual route and belongs in a password manager - or, if it is going somewhere less careful than that, seal the export under a passphrase and the second device will ask for it. Or switch on recovery, which stores a copy sealed under a passphrase and a passcode that only you hold, and sign in anywhere by unsealing it. Do one of them the day you sign up.
It is pseudonymous, and the difference matters. We hold no email address, no password and no phone number, but your connection still has an IP address and your uploads still have sizes and timestamps. If you need genuine anonymity against a serious adversary, use Tor and do not rely on any single service for it.
If you set nothing up, the account and everything in it are gone: we cannot email you a reset link, because we have no email address and nothing to reset. If you exported a backup, import it - and if you sealed that backup, you will need the passphrase you sealed it with, which we never received and cannot reset either. If you switched on recovery, your passphrase and passcode will bring the key back. What we can never do is help you when all of it is missing, and that is the direct cost of everything else on this page.
Yes. Sharing works by wrapping the tome key with the recipient's public key, so they need a keypair for it to be wrapped for. There is no public link that would let someone view a tome without an account.
For account recovery, for support, for marketing, and because an email address is a stable identifier that links your account to everything else you do with it. Removing it removes all four, the useful ones included - which is why recovery here is built on a passphrase you keep rather than a mailbox we could be compelled to mail.
Pick a username. That is the whole sign-up.
Then switch on recovery or export your key backup, before you upload anything you would hate to lose.
Create an account