How to verify that your photos are encrypted
Don’t take our word for it — check for yourself. · Русский · Қазақша
We claim three things: photos and videos are encrypted on your device before upload; the key never reaches our server; without the key nobody can open the files, including us. Here are four ways to check, from quick to thorough.
1. Look inside the app
Open any of your photos and tap “🔍 How this photo looks on the server” at the bottom of the card. The app downloads that file from storage without decrypting it and shows its real bytes. Your phone tries to open them as an image and fails: it is ciphertext. Next to it you see the same photo opened with your key, and what your caption, date, people and place look like to the server: one meaningless string.
2. Watch the network
You need a computer. Open web.telegram.org in Chrome or Edge, go to @MyAlbumsBot and tap “Open photos”. Press F12 and choose the Network tab. Upload a photo and click the upload request: its body contains three binary files and a meta_enc string. Try to find your photo, caption or a person’s name in it — they are not there. Go through every request: neither the key nor the recovery code is ever sent.
3. Read the code
The app is plain JavaScript — not obfuscated, no bundlers. You can read it right now:
- crypto.js — all the cryptography in about 120 lines: key creation, AES-256-GCM via the browser’s standard WebCrypto, the recovery code, secret-album keys (PBKDF2, 300,000 iterations).
- app.js — the app itself. Search for
fetch: these are all the calls to the server. Check that the key (exportB64,recoveryCode) is part of none of them and is stored only in your Telegram storage and on the device. - faces.js and fileinfo.js — “who is in this photo” suggestions and reading the capture date and place. All of it runs on the device; the result is encrypted together with the rest of the photo information.
If you know a developer, half an hour is enough.
4. The lost-key test
The most convincing check. Create a test account, upload a couple of throwaway photos and do not save the recovery code. Then open the app somewhere the key is missing (another browser at web.telegram.org) and ask us to restore access. We cannot: we have no copy of the key. If the server could open your photos, this test would be impossible.
What the server does see
The honest list: your Telegram ID and name; how many files you have and how large they are; when each was uploaded; whether it is a photo or a video; your plan and Stars payments. Cloudflare, which carries the connection, sees your IP address. Everything else — content, captions, people, capture dates and places, album names — is encrypted.
What we cannot prove
This is a web app: its code arrives from our server every time, so in theory we could swap it one day. No end-to-end-encrypted web service has fully solved this. Our answer is that the code is open and readable (method 3); as the project grows we will publish its history on GitHub and commission an independent audit. One more thing: encryption cannot help if someone else is holding your unlocked phone — that is what password-protected secret albums are for.
Questions: @Azike or [email protected].