Clann Is End-to-End Encrypted
Most photo apps ask you to trust a promise. This page lets you check one instead. Lock a photo below using the same encryption Clann uses, then try everything you can think of to get it back.
Pick a photo and watch it get locked
It never leaves this page — the locking happens right here in your browser, using the same encryption the Clann app uses on your phone.
No photo yet
On your phone
The photo is locked here, before anything is uploaded.
Nothing stored yet
On our servers
All we ever receive is the locked version.
On your family’s phone
It opens only on a phone that holds your family’s key.
Show the technical detail
This page imports @clann/e2ee, the open-source package our app’s encryption is built on, so the file produced above is a real CLN1 envelope: a 32-byte header followed by the photo sealed in chunks with AES-256-GCM in the OAE2 STREAM construction — a counter nonce per chunk with the final one flagged, and the header used as authenticated data so it cannot be edited independently of the body. That is why editing the label or shuffling the pieces breaks the file.
Lock a photo above to see the real header bytes it produced.
This simulator runs on @clann/e2ee, the same open-source library the Clann app encrypts with.
What is encrypted
In an encrypted family — every family created from August 2026 onwards, and any older family whose admin has switched it on — the media itself is encrypted on your device before upload:
- Photos — every stored size, including the small previews and thumbnails.
- Videos — encrypted the same way, and decrypted piece by piece as they play.
- Edited versions — crops and rotations are re-encrypted on your phone, never on a server.
- Location — removed from the file on your phone before it is uploaded at all.
If your family switches encryption on later, the photos and videos already in your library are encrypted too — not just new ones.
What is not encrypted is listed in full under known limitations — captions, comments and album names among them. We would rather you read that section than discover it later.
How Clann’s encryption works
The short version: keys are generated on phones, never on our servers. The detail, for anyone who wants to check it against the protocol document:
- AES-256-GCM — every photo and video is sealed with authenticated encryption, in 1 MiB chunks using the OAE2 STREAM construction. Authenticated means tampering is detected rather than silently passed on.
- Per-item keys — each photo and video gets its own random key, so one compromised item cannot unlock anything else.
- Group key epochs — your family shares a key, versioned by epoch. When someone leaves, a new epoch is issued and they cannot read anything uploaded after that point.
- X25519 key exchange — the family key is delivered to each member’s device inside a sealed box only that device can open. Our servers route these sealed packages without being able to open them.
- Ed25519 device identities — every device has a signing identity, and devices verify one another’s device keys rather than trusting our servers to say who is who. Your app warns you when a new device joins or an existing one changes.
- Recovery architecture — because keys live on devices, losing a phone is the real risk. Another family member’s device can restore your access, and a 12-word recovery phrase works when nobody else is available.
Can Clann see my photos?
No. In an encrypted family we cannot see your photos or videos. They are encrypted on your device before upload, and the keys that open them exist only on your family’s devices. Since August 2026 every new family is encrypted from the moment it is created, so for most families this is simply how Clann works. Our servers hold ciphertext and sealed key packages, and no key that opens them.
That covers the two things people actually worry about: us reading your photos, and someone stealing what we store. Our published threat model goes further and sets out what the design does and does not defend against, including the parts we are still working on.
What we can see is set out below, and you can check the encryption itself using the demo at the top of this page.
Is Clann’s encryption open source?
Yes. Clann publishes the cryptographic implementation and the protocol documentation publicly, so researchers and users can inspect how the system works rather than taking our description of it on trust.
The demo on this page imports that same published library, so the file it produces is a real encrypted file — not an illustration of one.
Known limitations
Encryption is not invisibility, and every honest system has edges. These are ours.
- Families created before August 2026 are not encrypted until an admin turns it on. New families are encrypted by default, but older ones need a deliberate step, because every member’s device has to hold a key before an existing library can be converted. Until that happens, those families are not encrypted. Once it is switched on, the photos and videos already in the library are encrypted too.
- Captions, comments and album names are not encrypted. Treat anything you type as readable by us. Extending encryption to cover them is work we intend to do.
- We can see basic metadata. That a file exists, who uploaded it, when, which family it belongs to, its size, and whether it is a photo or a video. We cannot see any other photo metadata — camera details, settings and anything else embedded in the file are removed on your phone before it is uploaded.
- Viewing in a web browser takes an extra step. The key never reaches our servers, so a browser has to be given one: a relative opens the link, and a family member approves that browser from their phone. It works, but it is not as effortless as clicking a link, and both screens show six words to compare so the approval cannot be intercepted.
What can Clann still see?
The same list, split plainly between what encryption covers and what it does not.
- We cannot see the photo or video itself, at any size, including thumbnails.
- We cannot see where an encrypted photo was taken.
- We can see that a file exists, who uploaded it, when, which family it belongs to, how big it is, and whether it is a photo or a video.
- We can see captions, comments and album names.
What happens if I lose my phone?
This is the question that actually matters with encryption, and the one most encrypted products answer badly. If keys only live on phones, a lost phone sounds like lost photos.
It is not, because your family is the backup. Anyone else in your family can restore your access from their own phone in a couple of taps — their device already holds the family key and passes a copy to your new one. If you would rather not depend on anyone else, you can save a 12-word recovery phrase in advance. Clann is deliberately built so getting locked out is hard, because for a family photo app that is a far more likely disaster than an eavesdropper.
Technical documentation
For researchers, journalists, and anyone a parent forwards this page to.
- Security at Clann → — the canonical reference: threat model, key handling, membership changes, metadata exposure, audit status and how to report a vulnerability.
- GitHub repository → — the cryptographic implementation, with its test suite and cross-language test vectors.
- PROTOCOL.md → — the normative specification: key hierarchy, file format, group membership and recovery.
- Threat model → — who this protects against, and what it explicitly does not protect against.
Common questions
End-to-end encrypted photo sharing means a photo is scrambled on your own phone before it is uploaded, and can only be unscrambled on the phones of the people you shared it with. The company storing the photo holds only the scrambled version, and no key that can open it, so it cannot see your photos even if it wanted to — and neither can anyone who steals the stored files.
Not in an encrypted family — which, since August 2026, means every newly created family by default. Photos and videos are encrypted on your phone before upload, and the keys are only ever stored on your family members’ devices. Our servers receive scrambled files and sealed key packages we cannot open. You can verify this yourself using the demo on this page, which runs the exact same file format the app uses.
Yes. Clann publishes the cryptographic implementation and the protocol documentation publicly, so researchers and users can inspect how the system works rather than relying on our description of it. The source is at github.com/ClannApp/clann-e2ee, and the interactive demo on this page imports that same published library, so the encrypted file it produces is a real one rather than an illustration.
Look for three things. First, a description specific enough to name what is encrypted and where the keys are kept. Second, a clear statement of what the company can still see, because every honest system has limits. Third, something you can check yourself, such as a published file format, published code, an independent audit, or a demonstration you can run. A claim that mentions no limits and offers nothing to check is worth treating carefully.
We cannot see the image or video itself, at any size. We can see that a file exists, who uploaded it, when, which family it belongs to, how large it is, and whether it is a photo or a video. Captions, comments and album names are not covered by the encryption yet, so treat those as readable by us. Location is removed on your phone before an encrypted upload, though photos added to an older family before it switched encryption on may still have location stored from that time.
Another family member’s phone can restore your access, because their device still holds the family key and can pass a copy to your new phone. There is also a 12-word recovery phrase you can save in advance, which works even if no other family member is available. Losing access is the realistic risk with encryption, so Clann is deliberately designed around recovery rather than making you memorise anything.
For new families, yes. Every family group created from August 2026 onwards is end-to-end encrypted by default, with no setup required. Families created before then need an admin to switch it on for everyone at once, because every member’s device has to hold a key before an existing photo library can be converted. Once encryption is on, every new photo and video is encrypted from the moment it leaves the phone.
They are encrypted too. When an older family switches encryption on, the photos and videos already in its library are converted as well, not just new uploads. It happens on a family member’s phone, since we never hold the key, and works through the library in the background.
No. A private album is a permission setting: the company can still open the file, and does, in order to generate thumbnails, scan content or train systems. End-to-end encryption is a mathematical limit rather than a policy, so it holds even if the company changes its terms, is bought, is hacked, or is compelled to hand over what it stores.
Barely. Photos are encrypted and decrypted on your phone in fractions of a second, and videos are decrypted in pieces as they play rather than all at once. The visible difference in day-to-day use is that viewing on a computer takes one extra step: a family member approves that browser from their phone before it can open anything.
Share family photos without an audience
Free to download.