Password-protected photo album: how to protect photos in your browser

Q: Are password-protected albums included in backups?

No. They are left out of the .zip backup and of the copy in a folder, so protected photos are never left open in a file. To back one up, remove its password first.

By webpins.net, updated on October 1, 2026

Clay illustration: a photo album closed with a padlock, and its key beside it

Looking for a password-protected photo album or gallery, online and free? In webpins you can protect specific albums with a password. The photos in those albums are encrypted and only open inside the album, after you enter its password. Here is how, step by step.

How to add a password

Create an album and put in it the photos you want to protect.
In the menu, open Manage › Password and click Protect with a password… next to the album.
Type a password (a long phrase is better than a word), repeat it and tick the box confirming you understand that a forgotten password cannot be recovered.
Click Protect with this password. The album's photos are encrypted right away.

The Protect Family with a password window, with the Password and Repeat the password fields and the confirmation box ticked — The protection window: the password twice, and confirming that it cannot be recovered.

Each album has its own password and its own key: opening one album does not open the others. On the same page you can lock an album again, change its password, take the password off and choose after how long without use the albums lock on their own.

The Password page listing the albums: Family protected and open, Trips and Landscapes with no password, and the automatic lock option — The Password page: where each album stands, and the automatic lock.

What the password protects

The album's photos: the originals, the thumbnails, the names, the captions and the dates.
The photos stay out of the rest of the gallery: they don't show in “All photos”, in search or on the albums' covers.
Protected albums close when you close or reload the tab, and can lock on their own after a time without use that you choose.

The Albums page where the Family album shows a padlock instead of its cover and the note Password protected — In the list of albums, a locked album shows only the padlock: neither its cover nor how many photos it has.

The This album is protected screen, asking for the password of the Family album — When you open a locked album, the site asks for the password before showing any photo.

How the encryption works

The photos are encrypted with AES-256. Each album's key is drawn at random in your browser and kept locked by the password, which is turned into a key with PBKDF2 and 600,000 rounds, so that guessing it is slow. The password and the key never leave your device: it all happens in the browser, with nothing sent to the internet.

If you forget the password, that album's photos cannot be recovered. There is no “forgot password” that brings the photos back: only the password opens the key, and neither webpins nor anyone else has a copy. Keep the password somewhere safe, such as a password manager.

What the password does not protect

The album's name and the fact that it exists: anyone who opens the site sees there is a protected album.
The album while it is open: anyone using the device while it is unlocked sees the photos. Lock it when you leave.
A compromised computer, with spyware: the password does not defend against that.
Backups: password-protected albums are left out of the .zip backup and of the copy in a folder, so protected photos are never left open by mistake. To keep them in a backup, take the password off first.

Encryption only works on secure addresses (https), which the published site already is.

Frequently asked questions

Can I recover an album's password?

No. The album's key only opens with its password, and neither webpins nor anyone else has a copy. If you forget the password, the photos in that album cannot be opened. Keep it in a password manager.

Are the photos in a password-protected album really encrypted?

Yes. The originals, thumbnails, names, captions and dates are encrypted with AES-256 in the browser itself. The password becomes a key through PBKDF2 with 600,000 rounds, and none of it leaves your device.

Can each album have a different password?

Yes. Each album has its own password and its own key, and opening one does not open the others.

Are password-protected albums included in backups?

No. They are left out of the .zip backup and of the copy in a folder, so protected photos are never left open in a file. To back one up, remove its password first.

Sources

About this guide: written by the maker of webpins.net. Each step was checked on the site itself on the date of the last update, and the pictures are real screenshots of it. The explanation of the encryption follows MDN's documentation, OWASP's recommendation and NIST's AES standard (see the sources above). Spotted something out of date? Write to hello@webpins.net.

Want to try it? Create a test album, add a password and see how it behaves.

Open webpins