Klenod and the alternatives

Good tools exist for keeping photos and videos private. Here is how Klenod compares, and when one of the others is the better choice.

	Klenod	Cryptomator	VeraCrypt	Photos Hidden album	Immich	Ente
Where files live	A folder on your Mac or a drive, your own S3 storage, or both	A vault folder, locally or in any synced cloud folder	An encrypted container file or drive	Your Photos library, and iCloud if you use it	Your own server	Ente's cloud, or a server you run with S3-compatible storage behind it
Encrypted at rest	Yes, by the app, including names, folders and tags	Yes, by the app, file by file	Yes, the whole volume	By FileVault on the Mac. In iCloud, end-to-end only with Advanced Data Protection	No, by design. The server relies on disk encryption	Yes, end to end by the app. The server never holds the keys
Thumbnails while encrypted	Yes, made in memory. No thumbnail cache on disk	Through Finder and Quick Look once unlocked. macOS can keep those thumbnails outside the vault	Through Finder once mounted. Quick Look caching was reported in 2018	Shown after Touch ID or your login password	Made and stored by the server	Made on your device and stored encrypted
Video playback	Streams from the encrypted library into memory, without decrypted temporary files	Plays from a mounted drive (FUSE or WebDAV)	Plays from the mounted volume	In Photos	Streamed by the server	In the app, from the encrypted copy
Mounted drive or kernel extension	None. The app reads the library itself: no mount, no FUSE, no kernel extension, nothing for Finder or Quick Look to cache	A virtual drive through macFUSE (a kernel extension), FUSE-T or WebDAV	macFUSE or FUSE-T on the Mac	None	None	None
Deleting a file	Recently deleted for 30 days, inside the encrypted library. Nothing passes through the Trash	Through the mounted drive. The system may move it to its Trash first	Through the mounted volume	Recently Deleted album for 30 days	Trash on the server	Trash in the app
Open links from MEGA, WeTransfer and others	Yes, six services	No	No	No	No	No
Share with one person	An encrypted link per person, with an end date and optional password	Share the vault folder and its password	Hand over the container and its password	Photos sharing	Share links and partner sharing, without end-to-end encryption	Shared albums with other Ente users, and public links with a password and end date
Second copy and integrity check	Built in	Copy the vault yourself	Copy the container yourself	iCloud Photos	Your server backups	Three copies in Ente's cloud on paid plans, one on the free plan
Account	None needed	None	None	Apple Account for iCloud	On your server	Ente account
Open source	Core MPL-2.0, rest source-available	Yes, GPL-3.0	Yes, Apache 2.0 and TrueCrypt licence	No	Yes, AGPL-3.0	Yes, AGPL-3.0
Independent audit	Not yet	Cure53, 2017 (encryption library)	QuarksLab, 2016 (not covering macOS)	Not published	Not published	Cure53, Symbolic Software and Fallible, per Ente
Platforms	Mac (preview), plus a command line for macOS and Linux. An iPhone viewer is planned	Windows, Mac, Linux, iPhone, Android	Windows, Mac, Linux. Needs macFUSE or FUSE-T on the Mac	Apple devices	Server, plus iPhone, Android and web	iPhone, Android, web, Mac, Windows, Linux
Price	Planned at $49 once or $24 a year. Opening and exporting your library is always free	Desktop free. Writing to a vault on mobile is paid	Free	Included	Free to self-host	Free up to 10 GB. From $2.49 a month for 50 GB, family sharing included. Free to self-host

We checked each product's own pages and issue trackers in October 2026, and the sources are listed below. If something has changed, tell us and we'll correct it.

Choose Cryptomator if

you want encrypted folders inside Dropbox, iCloud Drive or another sync service, on every computer and phone. It is mature, widely used and audited, and works with any sync client. It's built for files in general, and on the Mac, Finder and Quick Look can keep thumbnails of unlocked files.

Choose VeraCrypt if

you want a whole encrypted drive or volume that works on Windows, Mac and Linux, and don't mind mounting it by hand. It is very mature, audited, and offers hidden volumes. On the Mac it needs macFUSE or FUSE-T.

Choose the Photos Hidden album if

you mainly want photos out of casual view on your own devices and already use iCloud Photos. There's nothing to install, it works with Touch ID and Face ID, and you get Photos' editing tools. Turn on Advanced Data Protection for end-to-end encryption in iCloud. It opens with your Mac's login password, not a separate one.

Choose Immich if

you run a server you trust and want a full replacement for Google Photos: automatic phone backup, search, faces and several users. Your photos are protected by how you secure that server.

Choose Ente if

you want a private replacement for Google Photos: automatic backup from your phone, face and object search done on your device, shared albums, and apps on every platform, all end to end encrypted. It is open source and has had several independent audits. Your photos live in Ente's cloud with an account and a subscription, or on a server you run yourself.

Cloud photo services

Proton Drive also encrypts photos end to end in its cloud and backs up from your phone, with an account and a subscription.

Choose Klenod if

you want your photos and videos in one encrypted library that you can browse, watch and search, on storage you choose, without an account. Words in pictures, people and similar pictures are worked out on your Mac. It also suits you if people send you things through MEGA, WeTransfer, Proton Drive or Yandex Disk that you want to keep. It's new. It runs only on the Mac for now, and there's no phone app or independent audit yet.