End-to-end encrypted
The server stores opaque ciphertext and never holds a key. It cannot read an album title, a caption, or a photo — which is also why search and organization run on your device rather than on it.
Capsule
An end-to-end-encrypted, self-hosted photo and video library for people with terabytes of visual assets. In active development — no release has been cut yet.
What Capsule is
Section titled “What Capsule is”Self-hosted
Your server, your disks. Federation between servers is designed so sharing does not require anyone to centralize.
Recoverable by construction
Every asset is paired with a signed metadata sidecar, so a library is readable without a database and reconstructible from partial corruption.
Built for originals
RAW and video are first-class. Nothing is silently recompressed, and derivatives are signed so a corrupted thumbnail cannot pass for a good one.
Why it is built this way
Section titled “Why it is built this way”Most photo services ask you to choose between the features that come from a server reading your library and the privacy that comes from it not being able to. Capsule takes the second and rebuilds the features on the client: tagging, search, and grouping run against a local index over data only your devices can decrypt.
That choice has costs, and the design docs state them rather than hiding them — what a key-free server can and cannot tell you, what happens when a key is lost, and what a faulty or hostile client is prevented from doing.