Ente Photos
Free tierAn end-to-end encrypted photo library where the server only ever holds ciphertext
An open-source encrypted photo library that encrypts on device before upload, so the server holds only ciphertext that Ente itself cannot decrypt. It covers Android, iOS, Windows, macOS, Linux and the web with the features a photo app should have — face recognition, maps, memories — all computed on your own device. The server is AGPL and self-hostable.
Why we picked it
AGPL-3.0, from the same company and the same repository as Ente Auth, which we already list.
The problem with Google Photos is not usability — it is that your entire photo history sits in plaintext on an advertising company's servers and gets used to train models. Ente takes the same approach as its authenticator: photos are encrypted on your device before upload, and the server stores ciphertext. Face recognition, location clustering and "on this day" all run locally rather than by shipping photos up for the server to analyse.
The free tier is 10 GB, permanent rather than a trial. Beyond that, 50 GB starts at $2.49 a month. For keeping the photos that matter, 10 GB usually holds; pushing an entire phone library up means paying.
If you would rather not pay and would rather not trust their servers, the server code is AGPL — deploy it on a machine of your own and point the clients at it. That path is entirely free, and it is why the self-hostable badge is here.
To be clear about:
- An Ente account is required, as with Ente Auth. That is inherent to end-to-end encrypted sync, so there is no no-sign-up badge.
- Lose the master password and nobody can help you. The server cannot decrypt your data. Write the recovery key down and store it separately.
- For fully offline local photo management, look at digiKam. For a richer self-hosted photo service, look at Immich. Ente sits between them: hosted convenience with end-to-end encryption.