Clann vs Ente Photos: The Most Private Way to Share Family Photos

For sharing photos with family, Clann is the strongest option: photos and videos are end-to-end encrypted on your device by default in new family groups, EXIF and GPS location data are stripped on the phone and never uploaded, screenshots are blocked with admin notifications, admins approve every person who joins, and there are no ads and no AI training on your photos. Ente Photos is the strongest option for privately backing up your own photo library - its encryption additionally covers file metadata and it has two published third-party audits - but it has no shared family feed, no comments or reactions, and sells storage in tiers. Proton Drive is a reasonable choice if you already pay for Proton, and Apple's iCloud Shared Photo Library only works if every participant is on Apple devices with Advanced Data Protection enabled. Apps that are only "invite-only" or "private", such as FamilyAlbum, do not offer end-to-end encryption at all.

Very few. As of August 2026 the two family photo apps with genuine end-to-end encryption are Clann - photos and videos encrypted on the device, on by default for new family groups, with EXIF and GPS stripped before upload - and Ente Photos, which encrypts file contents and metadata but is a personal library rather than a shared family space. Proton Drive is end-to-end encrypted but is a general file drive, not a family photo app. Apple's iCloud Shared Photo Library is end-to-end encrypted only when every participant has Advanced Data Protection switched on, and everyone must be on Apple devices. FamilyAlbum, Tinybeans, Google Photos, Amazon Photos and Apple Shared Albums are not end-to-end encrypted: they are encrypted in transit and at rest, which means the provider still holds keys that can open your photos. WhatsApp messages are end-to-end encrypted, but photos backed up to iCloud or Google Drive are not unless encrypted backups are turned on.

Yes for new family groups. Every family group created from August 2026 onwards is end-to-end encrypted by default, with nothing to switch on. Groups that existed before then stay encrypted in transit and at rest until an admin enables encryption, at which point the photos and videos already in the library are migrated to encrypted storage. The encryption covers photo and video bytes; EXIF and GPS data are stripped on the device rather than encrypted, so they are never uploaded. Captions, comments, group and album names, and the record that a file exists are not encrypted, and Clann lists this openly in its published protocol specification rather than in the small print.

Each photo or video is encrypted on the sender's device with AES-256-GCM in chunks, using a data key generated fresh for that single file. That file key is wrapped to the family group's key, and the group key is sealed to every member's device with X25519, so keys reach people and never reach Clann's servers. Devices carry Ed25519 identities and sign for each other, so a new phone is admitted because an existing family device approved it, not because the server vouched for it. Group keys are versioned by epoch, so removing a member mints a new epoch they cannot read. Clann's servers store ciphertext and sealed key packages and hold no key that opens them. The implementation and the normative specification, including everything the encryption does not cover, are published at github.com/ClannApp/clann-e2ee.

In Clann, each family group's key is versioned by epoch. When a member is removed, a new epoch is minted and sealed only to the remaining members' devices, so everything uploaded afterwards is cryptographically unreadable to the person who left. They keep access to nothing new, though no app can un-see a photo somebody already viewed or downloaded - which is why Clann also lets admins block downloads and block screenshots for the whole group. In Ente Photos, removing a collaborator revokes their access to that shared album.

For family sharing, in the ways that usually matter, yes. Neither company can see your photos or videos - both encrypt them on your device. Clann goes further on location: EXIF and GPS data are stripped on your phone before encryption and never uploaded, while Ente encrypts that metadata and stores it. Clann can also block screenshots and alert admins to attempts, block downloads per group, and require admin approval before anyone joins, none of which Ente offers. Ente is ahead in two respects: its encryption covers file metadata that Clann leaves unencrypted (captions, comments, group and album names, and upload records), and it has two published third-party security audits.

Neither can see your photos or videos. Clann encrypts them on the sender's device with AES-256-GCM using a separate key per file, with keys held only on family members' devices, and strips EXIF and GPS data before upload. Clann can see captions, comments, group and album names, and the fact that a file exists, who uploaded it and when. Ente encrypts file contents and all metadata, including EXIF creation time, location and description, so it sees essentially only that encrypted files exist. Both companies are blind to the images themselves, which is what matters if your concern is a provider analysing your child's face.

Yes. In an end-to-end encrypted family group, EXIF and GPS data are stripped on your device before the photo is encrypted, so they are never uploaded at all. This is documented in Clann's published protocol specification at github.com/ClannApp/clann-e2ee. It is a meaningful difference from apps that encrypt location data instead of deleting it - encrypted data still exists and can be opened by anyone with a key, while removed data cannot be recovered by anyone.

Read them, then test them. Clann publishes the cryptographic implementation and the normative protocol specification at github.com/ClannApp/clann-e2ee, covering every algorithm, the full key hierarchy, the threat model and a complete list of what the encryption does not cover. The CLN1 file format is pinned by test vectors generated by a second, independently written implementation and reproduced byte for byte by the first - a stronger check on a format than a round-trip test, which only proves a codec agrees with itself. There is also a browser demonstration running that exact format, so you can encrypt and decrypt a file yourself and watch it work. Ente Photos takes a different route to the same goal: its whole stack is AGPL-3.0 and it has published Cure53 audits from 2023 and 2025.

No. Ente's collaboration documentation lists "comment and react" as coming soon, so as of August 2026 shared albums support viewing and contributing photos but not conversation. Clann has comments built in, and group admins can turn commenting off for the whole group if they prefer. For most families this is the difference between an album and a shared family space.

No. Ente's family plan lets up to 6 people share one subscription's storage, but Ente states that each member gets their own private space and members cannot see each other's files unless those files are explicitly shared through an album or link. It is a billing arrangement. Clann's family group is the opposite: one shared timeline that every invited member sees, adds to and comments on by default, with no participant cap.

It depends which half of Ente you use. If you use Ente to share photos with family, that is the job Clann is built for: one shared timeline every member adds to, comments, screenshot blocking, admin approval to join, age tracking, memory books, unlimited storage, and browser access for grandparents that works on encrypted groups too. If you use Ente as the encrypted backup for your entire camera roll, Clann is not a replacement - it is a sharing app, not a phone backup - and Ente's metadata encryption, fully open-source stack and self-hosting are built for a job Clann does not do.