Accounts
No email. No password. Just a username.
Every other service on our comparison pages wants an email address, and most want a password with it. Proton, Ente, MEGA, Tresorit, Google and Apple all do. We ask for a username, and this page explains both why and what it costs.
The keypair is the account
When you register, your browser uses the Web Crypto API to generate an RSA-4096 keypair. The public half is uploaded so other people can wrap tome keys for you. The private half stays on your device and is never transmitted.
Signing in means proving you hold that private key, not typing a secret we can compare against a stored hash. There is nothing on our side that could be replayed, cracked offline or dumped in a breach, because there is no credential on our side at all.
Why an email address is not a neutral request
An email address is a join key. It is the identifier that lets one dataset be matched to another, which is precisely why data brokers collect them and why breach dumps are searchable by them. Attaching one to a photo library links that library to everything else the same address has signed up for.
It is also the route through which account takeovers usually run. Compromise the inbox and you can reset the password on almost everything the address touches. A service with no email address and no password reset has closed that path entirely.
None of that makes email-based accounts wrong. They exist because recovery, support and communication are genuinely useful. It makes them a trade, and it is a trade most services make on your behalf without mentioning it.
The cost, which is not small
There is no way back in. No reset link, no support ticket that restores access, no recovery phrase we issue. If your private key is lost and you have no backup, the account and everything in it are gone, and we will not be able to help you however reasonable the circumstances.
Proton's recovery phrase and Ente's recovery key are better answers for most people, and we would rather say so than lose you to a surprise later. If a locked-out account would be a disaster rather than an inconvenience, choose one of those.
Export your key backup on the day you sign up. It takes a few seconds, it belongs in a password manager, and it is the entire difference between a lost laptop and a lost archive.
What we do not ask for, and what that costs
No email address
There is no field for one. Nothing links your tomes to an inbox, a marketing list, a data broker's join key or a breach dump.
No password
Nothing to phish, nothing to reuse from another site, and no password database to be stolen, because there are no passwords stored anywhere.
No phone number
No SMS verification, so no SIM swap risk and no phone number sitting next to your photographs in a database.
No tracking
No analytics scripts and no advertising identifiers. Fonts are served from Bunny rather than Google, so loading the page does not tell Google you were here.
No recovery, either
The same absence that removes the attack surface removes the safety net. Lose your key with no backup and the account is gone permanently.
No moderation queue
We cannot read your content, so we cannot review it. Nobody deletes your photos over a policy change, and nobody can check them for anything either.
Services that want your email address
vs Proton Drive
Proton is a general encrypted drive with an account you can recover. We are an encrypted media space with an account nobody can recover, including us.
End-to-end encrypted photosvs Ente Photos
Ente is an encrypted photo library with on-device intelligence. We are an encrypted shared space with no email address and discussion built in.
Mainstream cloud photosvs Google Photos
Google encrypts your photos and keeps the keys. We encrypt your photos and never have the keys.
Accounts without an email, asked and answered
Yes. Registration on ImageTome generates an RSA-4096 keypair in your browser and asks you to choose a username. There is no email field, no password field and no phone number. The keypair is the account.
You export your private key from the first device and import it on the second. That export is also your only backup, so do it the day you sign up and keep it in a password manager.
It is pseudonymous, and the difference matters. We hold no email address, no password and no phone number, but your connection still has an IP address and your uploads still have sizes and timestamps. If you need genuine anonymity against a serious adversary, use Tor and do not rely on any single service for it.
The account and everything in it are gone. We cannot email you a reset link, because we have no email address and nothing to reset. This is the direct cost of everything else on this page.
Yes. Sharing works by wrapping the tome key with the recipient's public key, so they need a keypair for it to be wrapped for. There is no public link that would let someone view a tome without an account.
For account recovery, for support, for marketing, and because an email address is a stable identifier that links your account to everything else you do with it. Removing it removes all five, the useful ones included.
Pick a username. That is the whole sign-up.
Then export your key backup, before you upload anything you would hate to lose.
Create an account