Frequently asked questions

Klenod is an encrypted library for your photos and videos, on your Mac. You can open links people send you from MEGA, Proton Drive, WeTransfer, Yandex Disk and other services, watch what's inside without downloading it, and keep the files that matter in a library only your passphrase opens.

People with photos and videos they care about, who don't want them scattered across services. A family with years of home videos. Someone who was sent a wedding album or a client delivery and wants to keep it. A filmmaker with raw footage. Anyone with private pictures they would rather not put in a big photo cloud.

Public links from MEGA, Proton Drive, WeTransfer, Yandex Disk and several other services, plus encrypted Klenod share links. Folders open with their subfolders, and you choose which files to keep.

Password-protected WeTransfer and Yandex Disk links are not supported yet. Proton Drive links with a password are.

No. Public links open without an account at the service that hosts them, and the Klenod app needs no account either. A passphrase opens your library folder.

Wherever you choose: a folder on your Mac, an external drive, an iCloud Drive or Dropbox folder, or S3 storage such as Cloudflare R2. Everything is encrypted before it is written, file names included. You pick the place on the unlock screen, and S3 keys can be kept in the macOS Keychain.

Klenod streams from the encrypted copy and decrypts into memory. It doesn't write decrypted files to disk to play them. The pieces it keeps in memory for smooth playback are locked out of swap, and its web view keeps nothing on disk. Every release is tested this way, on Macs of our own: after using the real app, we search the test Mac's whole disk for the files it played. How it's built has the details. macOS itself can still keep things outside Klenod's control, such as the player's own buffers in swap, which macOS encrypts. The security overview covers what is outside Klenod's reach.

No. Klenod has no analytics or crash reports, and it only connects to the services whose links you open and the storage you choose. It doesn't check for updates yet. The privacy page lists every connection it can make, and will say exactly what an update check sends before one is added.

No. When you open a cloud link, that service sees your network address and which files you read, as it would in a browser. You can send those connections through a proxy or Tor in Settings. Klenod protects what is stored in your library, not who you are on the network.

Not yet. An independent audit is planned. Anyone can read the source code to see how the encryption works, and the security overview lists what is and isn't protected.

Open Backup in Klenod and choose another drive or your own S3 storage for a second copy. Update it now and then. Only what's new is copied, and the copy opens with the same passphrase. Check library confirms every file is intact, and the recovery sheet is a page to print with where everything is and room to write your passphrase.

Yes. Put the library and the Klenod app on a USB drive, plug it into any Mac, and open it with your passphrase. You don't install anything, and you need no account, admin rights or kernel extension. Klenod decrypts into memory and keeps its keys and cached pieces out of swap. It writes no decrypted files and keeps no thumbnail cache, it stays out of Spotlight and screenshots, and it wipes its keys when you lock it. The library itself stays encrypted on the drive, and Klenod doesn't write your files to that Mac's disk in readable form. The details are in what Klenod protects.

Not by default. Klenod's window is left out of screenshots, screen recordings and screen sharing on your Mac, and you can turn that off in Settings. It can't stop a camera pointed at the screen.

If you made a recovery key, choose Forgot your passphrase? when you open the library, and enter the key to set a new passphrase. Without a recovery key, the library can't be opened, because Klenod keeps no copy of either. Make one in Backup, write it down by hand, and keep it with your recovery sheet, apart from the library.

Yes. Share a file, a folder or the whole library as an encrypted link. Each person gets their own link, with an optional password and an expiry date, and you can stop sharing at any time. You can also send someone a request link, so they can send files straight into your library.

Most MP4 and MOV files play directly. Older or unusual formats, such as WMV, FLV and some HEVC and 3GP files, play too: Klenod converts them as you watch, with the copy of FFmpeg that comes with the app. Play more video formats in Settings turns this off. It can also make a playable copy and keep the original.

It stays yours. The library is a folder you control, it opens offline, and its format is documented. The code that encrypts, stores and restores a library is open source under the MPL-2.0. That includes an open-source build of the klenod command-line tool, which opens, backs up, verifies and exports a library without the rest of Klenod. Your files never depend on us being around.

Klenod is for keeping copies of what was shared with you: a family album, a friend's trip video, files a client sent. Only keep files you have the right to keep. Klenod does not search for or index public links.

Opening, browsing, backing up and exporting your library will always be free, and the code that stores and restores a library is open source. The Mac app is planned at $49 once, with a year of updates, or $24 a year. Nothing is for sale yet. The pricing page has the details.

The Mac comes first. An iPhone app for viewing your library is planned. A command-line version already runs on macOS and Linux.