A photo library your own server can’t look into.
Your phone, Mac and browser seal every picture before upload. Your server keeps only ciphertext.
- Open source, AGPL-3.0
- Android, Mac and web
How the encryption works, in plain words
Every photo gets its own key.
Your device makes a fresh random key for each photo and video, and encrypts the file, its thumbnail and its details with it: name, date taken, place and camera.
Your password locks the keys.
Those keys are locked with a key that only your password, or your 24-word recovery key, can open. The password never leaves your device; the server keeps only a check value.
The server keeps sealed boxes.
It stores them and hands them back, but it cannot open one. Your device opens them, and refuses anything that was changed on the way.
What your server still sees
Encryption hides the content, not that it exists. Be clear about the rest:
The server sees
- the e-mail address each person signs in with
- how many photos and videos someone has, and roughly how big they are
- when items were uploaded or deleted, and when someone last signed in
- how many albums there are and which items are in which
- which photos are marked as favourites
It never sees
- your photos, videos and thumbnails
- file names, dates taken, places and camera details
- album names and the names of people
- what a photo shows or who is in it
- your password, your recovery key or any key
One limit to know about.
In the web app, your server delivers the code that does the encryption. Whoever controls the server could ship altered code. The Android and Mac apps are installed, so their code does not come from your server.
And one rule.
If you lose both your password and your recovery key, your photos are gone. Nobody can reset that, not even the admin. That is the point, and the app says so plainly.
Everything a photo library should do, without the peeking
A calm timeline, sorted by the day you took it
Albums, favourites, a lightbox, video with seeking, ZIP downloads and a trash that empties after 30 days. Originals are kept byte for byte: JPEG, PNG, WebP, HEIC, MP4 and MOV.
Search for “beach” or “dog”, on your own device
Open models run on your phone or Mac and find photos by what is in them. Faces are grouped into people you can name. The results go to your server encrypted, so a second device does not have to work them out again.
- Your deviceMobileCLIP and face models run locally, checked by SHA-256
- Your serverstores the results sealed, without reading them
- Other devicesread the results instead of computing them again
Backup from your phone, in the background
The Android app uploads new photos and videos by itself. The backup holds only a public key: it can add photos to your library, but it cannot read a single one.
A Mac app with watched folders
Choose folders, and new pictures in them are uploaded. The Mac app keeps an export folder up to date with your originals and builds the search index while it is unlocked.
Your photos, even without the app
A small, separate decrypt tool restores your originals, albums and dates straight from the server’s data folder or a backup, with your password or recovery key. No network, no Docker, no Cipherfilm code.
Your pictures, full screen
A quiet black viewer with a filmstrip, the details of each photo and the original one click away. Everything is decrypted in your browser as you look.
Get Cipherfilm
You run the server; the apps connect to it. Everything is free and open source.
- ServerOne Docker image for amd64 and arm64, with the web app built in. Runs on Linux or macOS.
- Web appComes with your server. Works in any current browser, also on iPhone and iPad (there is no iPhone app yet).
- AndroidThe app with automatic backup, as an APK file for phones with a 64-bit ARM processor.
- MacFor Macs with Apple silicon and macOS 15 or newer, with watched folders and an export folder.
- ToolsAn upload tool for big folders from a Mac, and the decrypt tool for macOS, Linux and Windows.
The download page on GitHub explains how to install it on each platform and always leads to the newest release. Not in Google Play or the App Store yet.
Self-hosting in a few lines
You need a machine with Docker: a small VPS, a NAS or your Mac. Cipherfilm runs comfortably on 1 to 2 CPUs and 2 GB of memory, and uses about 35 MB when idle.
One compose file runs the released image with Caddy, which gets the HTTPS certificate by itself. Point a DNS name at the machine, start it, and create the first account with the one-time token from the log. Without open ports via Tailscale, or behind your own proxy: see the README.
$ mkdir cipherfilm && cd cipherfilm
$ curl -fsSLO https://raw.githubusercontent.com/basmatiactivist/cipherfilm/master/deploy/quickstart/compose.yaml
$ echo "DOMAIN=photos.example.com" > .env # your DNS name
$ docker compose up -d
$ docker compose logs app | grep "FIRST-TIME SETUP"- Invite-only: you create invite links and hand them over yourself. Cipherfilm never sends e-mail.
- Manage people from the server: docker compose exec app /app help.
- Back up with one script. The backup is ciphertext too, so it can live anywhere.
Open source, and honest about it
Cipherfilm is licensed under the GNU AGPL-3.0. The encryption uses libsodium, a widely used library, and no home-made cryptography. The decrypt tool reimplements the format separately, so your data does not depend on the app.
It is young software. It has not had an independent security review yet. Read the threat model before you trust it with anything you could not bear to lose, and keep your own backups.
Questions
What does it cost?
Nothing. Cipherfilm is open source and you run it on your own server. There is no account with us and no subscription.
Can the admin see my photos?
No. The admin can invite and remove people, set storage limits and see the metadata listed above, but cannot open anyone’s photos, file names or album names.
What if I forget my password?
Sign in with your 24-word recovery key and set a new password. If you lose both, the photos cannot be recovered by anyone. Print the recovery key and keep it somewhere safe.
How can search work if the server can’t see the photos?
Your phone or Mac looks at each photo with open models and stores what it found, encrypted, on your server. Searching happens on your device too.
Do I need my own server?
Yes. Any machine with Docker will do, from a small VPS to a Mac at home. With Tailscale it needs no open ports at all.
Is there an iPhone app?
Not yet. The web app works in Safari on iPhone and iPad.
Can people share albums with each other?
Not yet. Each person has a fully private library.
Has it been audited?
Not by an independent reviewer yet. It was written with the help of AI agents and checked in several rounds of automated source audits; what they found and fixed is listed in the security policy.
Can I get my photos out again?
Always. Download originals one by one or as a ZIP, or restore everything with the decrypt tool, even when the server is gone.
Who makes Cipherfilm?
An independent open-source project published as basmatiactivist on GitHub. Write to us at the address below.