Password-protected photo album: how to protect photos in your browser

In webpins you can protect specific albums with a password. The photos in those albums are encrypted and only open inside the album, after you enter its password.

How to set a password

1. Create an album and put in it the photos you want to protect.
2. Open the Password page and choose Protect with a password on the album.
3. Enter a password (a long phrase is better than a single word) and confirm it.

Each album has its own password and its own key: opening one album does not open the others.

What the password protects

• The album's photos: the originals, the thumbnails, the names, the captions and the dates.
• The photos stay out of the rest of the gallery: they do not show up in “All photos”, in search or on album covers.
• Protected albums close when you close or reload the tab, and can lock on their own after a period of inactivity that you choose.

How the encryption works

The photos are encrypted with AES-256. Each album's key is generated at random in your browser and kept locked by the password, which is turned into a key with PBKDF2 and 600 thousand rounds, so that guessing it is slow. The password and the key never leave your device: everything happens in the browser, with nothing sent to the internet.

What the password does not protect

• The album's name and the fact that it exists: anyone who opens the site sees that there is a protected album.
• The album while it is open: anyone using the device with it unlocked sees the photos. Lock it when you leave.
• A compromised computer, with spyware: the password does not defend against that.
• Backups: albums with a password are left out of the .zip backup and of the copy in a folder, so that protected photos are not left open by mistake. To keep them in a backup, take the password off first.

Encryption only works on secure addresses (https), which the published site already uses.