蔵 Open source · Self-hosted · End-to-end encrypted
Your photos, kept in a storehouse only you can open.
Kura Vault is photo and video storage you run on your own server. Every file is encrypted on your device before it is uploaded, so the server, the database and the storage bucket only ever hold ciphertext.
Get it on Google Play Open the web app
- MIT licence
- AES-256-GCM
- Argon2id
- X25519 + Ed25519
- No tracking in the apps
Why it exists
Whoever holds the disk holds the photos.
Cloud photo services keep the keys to your library. Most self-hosted photo apps do the same thing on your own hardware: the server reads every photo so it can index it, which means anyone with the server, its backups or its storage bucket can look through it too.
Kura Vault takes the other path. The server stores and sorts your library without ever seeing inside it. You can put it on a cheap VPS or in a cloud bucket, share it with family, and none of those places learn what your photos show.
How it works
Encrypted on your device. Stored as noise.
Someone with full access to the API, the database and the bucket still cannot view anything without a user’s master passphrase.
-
1 · Your device
Encrypted before it leaves
Each photo or video gets its own random key and is encrypted with AES-256-GCM, along with its file name, location and other metadata. The key is wrapped by the vault key, which is sealed under keys derived from your passphrase with Argon2id.
IMG_2210.HEIC→ 3f9a c2e1 77b0 … -
2 · Your server
Stores what it cannot read
PostgreSQL holds wrapped keys, salts, public keys and the metadata needed to sort and authorise. The bucket holds opaque blobs. Uploads and downloads go straight to the bucket with short-lived pre-signed URLs.
media/8c1e…/originalapplication/octet-stream -
3 · Your devices and people you share with
Decrypted only where a key is
Your other devices unlock with your passphrase. Someone you share with receives the vault or album key sealed to their public key and signed by you. Nothing is re-encrypted and no passphrase is shared.
Seal(X25519, vault key)signed with Ed25519
The full design, threats and limits are on the security page.
What it does
A private photo library for you and the people you trust.
-
Vaults that stay out of sight
Create as many vaults as you like, each with its own passphrase. Entering one opens only the vaults it matches. The others are not even listed.
-
Share without sharing a passphrase
Share a whole vault or a single album, for viewing or for adding. The key is sealed to the other person’s public key on your device. The server only relays ciphertext.
-
Straight to storage
Uploads and downloads use short-lived pre-signed URLs, so media bytes never pass through the API. Bring your own S3 bucket or use the bundled one.
-
Invite-only accounts
There is no sign-up page. The owner adds people with one-time invite links, decides who may create vaults, and can cut an account off at once. The owner still cannot read anyone’s vault.
-
Bring your library with you
A command-line tool encrypts an existing folder of photos and videos on your computer, uploads it, and resumes if interrupted.
-
Android and web
Use the Android app with fingerprint or face unlock, or the web client in any current browser. Keys live in memory only and are destroyed when the vault locks.
The name
蔵, the storehouse.
A kura is the thick-walled Japanese storehouse that kept a family’s valuables safe from fire and theft. Its plastered walls outlasted the house beside it.
The mark shows one from the gable end, with a keyhole for a door. The thin gap under the roof is the kura’s raised, ventilated outer roof, the 置き屋根 (okiyane). Our colours are aizome, the indigo of Japanese dye, and the off-white of lime plaster.
Security at a glance
Three secrets, and only one reaches the server.
The password signs you in. The passphrases open your keys, and they never leave your device.
An honest status
Kura Vault is young and has not had an independent security audit yet. The design is documented in full and open to review. Until it is audited, don’t make it the only copy of anything you care about.
| Secret | What it opens | Who sees it |
|---|---|---|
| Password | A session on the server | The server, once per sign-in, to check a bcrypt hash |
| Master passphrase | Your account’s private keys | Nobody. It is checked on your device |
| Vault passphrase | A vault you created | Nobody |
- Every ciphertext authenticates the ids it belongs to, so the server cannot swap keys or files between rows.
- Keys are sealed only to users whose keys the owner certified, and used only if their sender signed them.
- Keys are held in memory and destroyed on lock, after at most 15 idle minutes, and when the app or tab closes.
- Three independent implementations are kept byte-compatible by shared test vectors.
Self-host
One command, on your own server.
The installer downloads a release, checks every file against its published checksums, generates all secrets, and asks before it starts anything. It needs no root.
- Server
- Linux, amd64 or arm64, 1 CPU and 1 GB of memory
- Runtime
- Docker with Compose v2
- Storage
- Bundled Garage, or AWS S3, Cloudflare R2, Backblaze B2
- HTTPS
- Caddy, nginx, Traefik or Cloudflare Tunnel in front
curl -fsSLO https://github.com/greytimelabs/kura-vault/releases/latest/download/install.sh
less install.sh && sh install.shRead install.sh before you run it. # it's short
It brings up the API, the web client, PostgreSQL and the bundled storage. Put your HTTPS proxy in front, open the address and enter the setup key the installer printed. Then invite your family. See the self-hosting guide for upgrades, backups and your own bucket.
Compared
What you trade for end-to-end encryption.
A server that cannot see your photos cannot index them either. If face recognition matters more to you than privacy from the host, another app may suit you better. We say so on each comparison.
| Kura Vault | Immich | Ente | Google Photos | PhotoPrism | |
|---|---|---|---|---|---|
| End-to-end encrypted | Yes | No | Yes | No | No |
| Self-hosted | Yes | Yes | Yes | No | Yes |
| Open source | Yes | Yes | Yes | No | Yes |
| Face recognition and smart search | No | Yes | Yes | Yes | Yes |
Google Photos column: Google Photos. iCloud Photos is end-to-end encrypted only with Advanced Data Protection turned on. Kura Vault does not have automatic background backup or an independent audit yet. Details and sources on each comparison page.
Questions
Frequently asked
Is Kura Vault free?
Yes. Kura Vault is open source under the MIT licence and free to self-host. You pay only for your own server and storage. Greytimelabs does not sell a hosted plan.
Can the person who runs the server see my photos?
No. Photos, videos, file names, location data, album names and vault names are encrypted on your device before upload. The server stores only ciphertext and wrapped keys, and the owner account cannot open a vault that was not shared with it. The server does see structural metadata such as usernames, item counts, capture times, dimensions and file sizes.
What happens if I forget my master passphrase?
Everything only your account could open becomes permanently unreadable. There is no recovery and the server owner cannot reset it. This is deliberate: a recovery path would also be a way in.
What do I need to self-host it?
A Linux server (amd64 or arm64) with at least 1 CPU core and 1 GB of memory, Docker with Compose v2, a domain name, and HTTPS from a reverse proxy such as Caddy, nginx, Traefik or Cloudflare Tunnel. The installer downloads a release, checks it against published checksums and generates every secret.
Which storage does it work with?
The default install bundles Garage, an S3-compatible store, on the same server. You can instead use your own bucket on any S3-compatible service, such as AWS S3, Cloudflare R2 or Backblaze B2. The bucket only ever holds ciphertext.
Is there an iOS app?
Not in the App Store yet. The Android app is on Google Play, and the web client works in any current browser, either from your own server or from the hosted client at kura-app.greytimelabs.com.
Has Kura Vault been independently audited?
Not yet. The design, the cryptography and the security rules are documented in the repository, and three independent implementations are kept byte-compatible by shared test vectors. Until there is an audit, do not make Kura Vault the only copy of anything you care about.
How do I bring in my existing photo library?
Use the migration CLI. It encrypts an existing folder of photos and videos on your computer and uploads it, and it can resume if it is interrupted.
How does sharing work without sharing a passphrase?
Each vault and album has its own random key. To share, your device seals that key to the other person’s public key and signs it. Nothing is re-encrypted, and the server only relays the sealed key. You can share a whole vault or a single album, for viewing or for adding.
Does it have face recognition or smart search?
No. The server cannot see your photos, so it cannot index them, and the apps do not analyse photos on the device. If AI search matters more to you than end-to-end encryption, a server-side app such as Immich is a better fit.
Keep your memories where only you hold the key.
Free and open source. Your server, your bucket, your keys.