Free · Real AES-256 · On your device

Lock a photo with a password

Scramble a photo or document (PDF, ID, form) so only someone with your password can open it. The encryption happens in your browser — nothing you lock ever touches our servers.

🔒 Nothing is uploaded. We can't see it, and we can't unlock it.

Keep it generic — the file name isn't encrypted, only the file itself is. (The real name is restored, privately, when it's unlocked.)

How to send it: download the locked file and send it as a file/attachment (WhatsApp doc, email, AirDrop, a link). Share the password separately (never in the same message).

Two honest limits: (1) once someone opens it with the password, they can save it — like any photo you send (no tool can stop that). (2) Don't post the locked file to a feed/story — those apps re-compress images and it would be ruined for good.
📥 How to save the file and open it on your phone

📱 iPhone (Messages, Mail, etc.)

1. Tap the locked .txt file someone sent you.
2. Tap the share icon ⬆ and choose Save to Files.
3. Come back here, open the Unlock tab, tap Choose the locked file → Browse, and pick it from Files. Enter the password and tap Uncrumble.

🤖 Android (Messages, Gmail, etc.)

1. Tap the locked .txt file (or the download arrow) to save it to Downloads.
2. Come back here, open the Unlock tab, tap Choose the locked file, and pick it from Downloads or Files. Enter the password and tap Uncrumble.

The file is safe to save and open. It is just scrambled text until it is unlocked with the password, and everything happens on your own phone.

🔐 Is this actually secure? (yes — here's exactly how)

The encryption is real, not a gimmick. Your password is stretched with PBKDF2 (1,000,000 rounds) into a 256-bit key, and the photo is sealed with AES-256-GCM — the same standard banks and Signal use. Brute-forcing the key is infeasible.

The password is never stored. Not on our servers, not in the file. The locked file holds only the scrambled data + a random salt + a random IV — never your password. Unlocking re-derives the key from the password you type. We literally cannot open your file, and there's no backdoor or reset.

The only weak link is your password. A weak password ("1234") could be guessed by someone who steals the locked file. Use a strong one — or tap 🎲 and we'll generate one for you.

Unlocks: unlimited — it's a self-contained file, openable by anyone with the file + password, on any device, forever. (A "self-destruct / open-once" mode would need a server to hold and delete the file, which we deliberately don't do.)

When to password-protect a photo

Any time an image is more sensitive than the app you'd send it through:

🪪 IDs & documents
Sending a passport, driver's license, or a signed form to someone who genuinely needs it — a landlord, an employer? Lock it so only they can open it, not whoever else sees the chat. Check who is asking first: a real company almost never needs your ID over chat out of the blue, and a lock cannot make an untrustworthy recipient safe.
🔐 Private photos
Personal pictures meant for one person only — encrypted in transit and at rest, so a hacked account or a nosy screen can't reveal them.
🧾 Sensitive screenshots
Bank details, medical results, anything you wouldn't want sitting readable in someone's message history forever.

Crumble is a lock for something you were already going to send — not a records service or a compliance product. Where a bank, clinic, or government body offers its own secure portal, send regulated documents through that instead, and never let a locked copy be your only copy. See our Terms.

Common questions

How do I password-protect a photo?
Choose your photo, set a password, and tap Crumble. It encrypts the photo in your browser and gives you a locked file. Send the file, and share the password separately; the other person opens it here with the password.
Is the photo or password uploaded to a server?
No. Everything happens in your browser. The photo and the password never leave your device, and the password is never stored — not on our servers, not in the locked file.
Is it real encryption?
Yes — AES-256-GCM with a key stretched from your password via PBKDF2 (1,000,000 rounds), the standard banks and secure messengers use. Without the password the photo can't be opened, and there's no backdoor.
What if I lose the password?
The photo is gone — the password isn't stored and there's no recovery. Keep the password safe, or use the built-in 🎲 strong-password generator and save it somewhere.
Can the person I send it to reshare the photo?
Once they open it with the password, they have the photo and can save it — like any photo you send. Encryption protects it in transit and at rest, not after someone opens it. No tool can prevent that.