Ente — End-to-End Encrypted Photo Storage & 2FA

What Ente Does

Ente Photos

• E2E Encrypted Backup: All photos and videos encrypted before leaving your device
• Cross-Platform: Native apps for iOS, Android, macOS, Windows, Linux, and web
• AI Search: On-device ML for face recognition and object search (runs locally, not on server)
• Shared Albums: Share albums with family with E2E encryption maintained
• Memories: "On this day" flashbacks
• Archive & Trash: 30-day trash with recovery
• Map View: View photos by location
• Deduplication: Automatic duplicate detection

Ente Auth (2FA)

• E2E Encrypted 2FA: TOTP tokens encrypted and synced across devices
• Import: From Google Authenticator, Authy, Bitwarden, and more
• Offline Access: Works without internet once synced
• Cross-Platform: iOS, Android, macOS, Windows, Linux, web

Architecture

┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│ Client Apps  │────▶│  Ente Server │────▶│  PostgreSQL  │
│ (Flutter/Web)│     │  (Go)        │     │  (Metadata)  │
│ E2E Encrypt  │     └──────┬───────┘     └──────────────┘
│ on device    │            │
└──────────────┘     ┌──────┴───────┐
                     │  MinIO / S3  │
                     │  (Encrypted  │
                     │   Blobs)     │
                     └──────────────┘

Key: Encryption/decryption happens entirely on the client. The server only stores encrypted blobs it cannot read.

Self-Hosting

Docker Compose

services:
  museum:
    image: ghcr.io/ente-io/server:latest
    ports:
      - "8080:8080"
    environment:
      ENTE_DB_HOST: postgres
      ENTE_DB_PORT: 5432
      ENTE_DB_NAME: ente
      ENTE_DB_USER: ente
      ENTE_DB_PASSWORD: ente
    depends_on:
      - postgres
      - minio
    volumes:
      - ./museum.yaml:/museum.yaml:ro

  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: ente
      POSTGRES_PASSWORD: ente
      POSTGRES_DB: ente
    volumes:
      - pg-data:/var/lib/postgresql/data

  minio:
    image: minio/minio
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    volumes:
      - minio-data:/data

volumes:
  pg-data:
  minio-data:

Zero-Knowledge Encryption

Your Device                      Server
─────────                        ──────
Generate key from password
        │
Encrypt photos with key
        │
Upload encrypted blob ──────▶ Store encrypted blob
                               (cannot decrypt)
        │
Download encrypted blob ◀────── Send encrypted blob
        │
Decrypt with key
        │
View photos

• Master key derived from your password (never transmitted)
• Each file encrypted with unique key
• File keys encrypted with master key
• Server stores only ciphertext

Ente vs Alternatives

FAQ

Q: Ente or Immich? A: If privacy and encryption matter most, choose Ente (end-to-end encrypted — even a compromised server can't read your photos). If you care more about feature richness and AI search, choose Immich (more powerful server-side ML search, but you must trust the server).

Q: Can self-hosted Ente Auth replace Google Authenticator? A: Absolutely. Ente Auth imports from Google Authenticator and provides encrypted cloud backup and multi-device sync — features Google Authenticator lacks.

Q: Self-hosted storage costs? A: Storage capacity in the self-hosted version depends on your MinIO/S3 setup. You can use local disks or any S3-compatible object store. The official cloud service starts at $1.99/month for 10GB.