End-to-end encrypted
The server stores opaque ciphertext and never holds a key. It cannot read an album title, a caption, or a photo — which is also why search and organization run on your device rather than on it.
Capsule
An end-to-end-encrypted, self-hosted photo and video library for people with terabytes of visual assets. In active development — no release has been cut yet.
What Capsule is
Section titled “What Capsule is”Self-hosted
Your server, your disks. Federation between servers is designed so sharing does not require anyone to centralize.
Recoverable by construction
Every asset is paired with a signed metadata sidecar, so a library is readable without a database and reconstructible from partial corruption.
Built for originals
RAW and video are first-class. Nothing is silently recompressed, and derivatives are signed so a corrupted thumbnail cannot pass for a good one.
Your whole library, offline
Every native app is built to hold a full index of every photo you have kept, so you can browse, search and organize all of it with no connection. More.
Why it is built this way
Section titled “Why it is built this way”Most photo services ask you to choose between the features that come from a server reading your library and the privacy that comes from it not being able to. Capsule takes the second and rebuilds the features on the client: tagging, search, and grouping run against a local index over data only your devices can decrypt.
That choice has costs, and the design docs state them rather than hiding them — what a key-free server can and cannot tell you, what happens when a key is lost, and what a faulty or hostile client is prevented from doing.