Image Tool

Lock Image with Password

Lock an image with a password. It is encrypted in your browser with AES-256-GCM and saved as one HTML file: whoever opens that file in a web browser and types the password sees the image and can save the original. Nothing is uploaded.

Drop your file here, or browse

JPEG, PNG, WebP, GIF, AVIF, BMP, HEIC · encrypted in your browser

Related tools

View-Once Image
Share an image by a link that opens once
Compress Image
Reduce image file size
Protect PDF
Password protect your PDF

How to Lock Image

  1. Add your image

    Drop a JPEG, PNG, WebP, GIF, AVIF, BMP or HEIC image. It is shown large so you can check it is the right one.

  2. Choose a password

    Type it twice. The strength bar is a rough guide to its length and mix of characters.

  3. Lock and download

    Press "Lock image", then "Download". Send the .html file, and tell the recipient the password some other way.

Features

  • AES-256-GCM authenticated encryption
  • PBKDF2-SHA-256 key derivation (600,000 iterations)
  • One self-contained HTML file that opens offline
  • Nothing uploaded: encrypted in your browser
  • Works in any modern browser
  • Password strength meter
  • Unlocking gives back the original image, byte for byte

Frequently Asked Questions

How is the locked file opened?
Open the .html file in a web browser (Chrome, Edge, Firefox or Safari) and type the password. The image appears, with a Save image button that gives back the original file. A preview inside a mail or chat app may not run the file, so save it first and then open it.
Does it need an internet connection to open?
No. The code that decrypts the image is inside the file, and it contacts nothing.
How strong is the encryption?
AES-256-GCM, with the key made from your password by PBKDF2-SHA-256 with 600,000 rounds and a random salt. The weak point is the password: anyone who has the file can try passwords on it offline as often as they like, so use a long one.
What if someone types the wrong password?
The file says the password is wrong and shows nothing: AES-GCM checks the key before anything is decrypted. There is no limit on attempts, which is why the password should be long.
Is my image uploaded?
No. It is encrypted in your browser and the locked file is saved straight to your device.
Is the image changed?
No. It is locked byte for byte as it is, including anything stored inside it such as camera details or location, which are there again once it is unlocked.