A private image library, locked with your own passphrase.
Tag your images with vocabularies you design, find any of them with a few typed words, and keep every image, and everything about it, encrypted before it's stored.
trips:"pacific coast" color:blue@top is:landscape -is:blurry rating:4+
One filter, as typed: from the Pacific coast trip, landscape and sharp, with blue across the top, rated four stars or more.
Everything in its place
Built for collections of thousands of images, where finding the one you want matters as much as keeping it safe.
-
Private by design
Images, titles, tags, notes, dates, camera details, and places are encrypted before they're stored, and so is each vault's name. Without your passphrase or recovery key, the stored data says nothing about what your images are.
-
Your own vocabularies
Make vocabularies for whatever matters to you, such as people, places, projects, or styles, each with its own color, as a flat list or a tree. Rename, move, and merge terms whenever you like; your images follow.
-
Fast filtering and search
Type a few words to filter by terms, dates, ratings, cameras, places, shapes, or colors, even where a color sits in the frame (
color:yellow@bottom-right). The sidebar shows how many images each filter would leave, and you can save the searches you come back to. -
Find similar and duplicates
Pick any image to see the ones that look like it, by color, composition, or both. The Duplicates view gathers near-identical copies, resized and flipped ones included, suggests which to keep, and remembers the pairs you've said are different.
-
Import from galleries
A companion Chrome extension sends images from web pages to your library, each keeping the page it came from. Or import a whole gallery: it scrolls the page for you, looks for each image's full-size version, and skips what your vault already has.
-
Tagging that keeps up
Suggested terms come from images that look alike, and the keyboard does the rest: step through results, add terms, rate, and favorite without the mouse. Or select hundreds of images and tag them at once.
And more
- Several vaults, each with its own passphrase, recovery key, and vocabularies.
- Image analysis and place names are worked out on ToucanTrove's own server, from place data bundled with the app, so no coordinates go to a mapping service.
- A privacy blur for viewing in public, one key away.
- Ratings, favorites, and plain-text notes on every image.
- A trash you can restore from. Emptying the trash or deleting a vault needs your passphrase.
- Export a whole vault, as image files with their details in JSON, and import it again.
- Wide-gamut photos, such as Display P3 and Adobe RGB, keep their own colors.
- Sign in with a passkey, or a password with two-factor authentication if you turn it on.
- Passphrase attempts are slowed and limited.
How your privacy works
ToucanTrove is built so that what it stores can't be read without your passphrase. Here's how, in plain terms.
Passphrase
Argon2id turns it into your key
Recovery key
Shown once
Vault key
Images and every detail
-
You choose a passphrase.
Each vault has its own, at least 16 characters long. It's never stored. When you unlock, it's turned into a key with Argon2id, a method built to make every guess slow and costly, and that key opens your vault.
-
Everything is encrypted before it's stored.
That covers every image and thumbnail and everything about them: titles, tags, notes, ratings, dates, camera details, locations, and file names. Your vault's name, vocabularies, and saved searches are encrypted too. Uploads are processed in memory, so an unencrypted image is never written to disk. Stored copies are stripped of the original file's metadata, apart from its color profile.
-
It locks itself.
While a vault is unlocked, its key is split between your browser and the server, and neither half opens anything alone. The vault locks after the idle time you choose, when you lock it, or when you sign out, and it can lock as soon as you switch away from its tab. Unlocking it on one device locks it everywhere else.
-
A recovery key, shown once.
Creating a vault gives you a recovery key, the only other way in. It's shown once and never stored. Using it sets a new passphrase and gives you a new recovery key. Lose both the passphrase and the recovery key, and no one can open the vault, not even whoever runs the server.
-
Your password isn't your passphrase.
Your account password signs you in, but it opens no vault. Someone who learned it would find nothing inside your vaults and couldn't change them.
What it doesn't protect against
Someone who took control of the server while your vault was unlocked could read it, since that's when the server holds its key. And some things show without opening anything: how many images there are, and roughly how large each one is.
Because unlocking happens on the server, using ToucanTrove means trusting whoever runs it not to change the app to capture passphrases. Without your passphrase nothing on the server can open a vault, but the code it runs could be changed.
For the technically curious: all encryption is libsodium. Argon2id turns passphrases into keys; XChaCha20-Poly1305 seals each record, and secretstream seals each image file in chunks. Every ciphertext is bound to the record it belongs to and its purpose, and records in the database are padded so their sizes say little.
ToucanTrove isn't open to the public.
It's a private library, used by its owner and invited guests. If you have an account, sign in. If you've been invited, open the link in your invitation to set up yours.
Sign in