How to Use Ente: The Beginner's Guide (First Deploy, the 7-Taps Rule, Your First Backup, and the Recovery-Key Lesson)

CodexFuse Team · 2026-11-01T11:11:26.732Z · 13 min read

Ente is the end-to-end encrypted Google Photos alternative. This beginner guide covers the cloud-vs-self-host decision, the recovery-key lesson, the 7-taps rule, and your first backup.

Learning how to use Ente starts with one uncomfortable sentence: Ente is an end-to-end encrypted photo library that neither its cloud operator nor your own self-hosted server can peek into — and because nobody can peek, nobody can rescue your account for you either. Your recovery key, a 24-word phrase generated when you sign up, is the only way back in if you forget your password. Save it now, before you back up a single photo.

Ente (ente.io — not the Kerala land-records portal "Ente Bhoomi" that sometimes pollutes this exact search) is the privacy-first answer to Google Photos: your photos are encrypted on your device before they ever leave it, the whole stack is open source, a free 10 GB tier lasts forever, and if you would rather not trust anyone's cloud at all, you can run the server on your own hardware. This beginner guide takes you from zero to your first backed-up photo in one sitting: cloud versus self-host, the account and recovery-key lesson, the deploy, the S3 storage story, the 7-taps rule, and sharing. If you would rather have server-side machine learning than encryption, our Immich beginner guide covers the sibling product; and if Docker Compose files are still new to you, our Docker beginner guide will make the deploy section feel trivial.

What Is Ente?

Ente is an end-to-end encrypted photo storage service (E2EE) built to replace Google Photos without the surveillance. Your photos, videos, and metadata are encrypted on your device with keys only you hold, then synced to Ente's cloud or to a server you run yourself. The result is a Google Photos–style library — timeline, albums, search, sharing — where the operator sees only ciphertext.

The product family has four parts: Ente Photos (the library), Ente Auth (a free two-factor-authenticator app), Ente Locker (a private vault for documents and files), and the self-hostable server, called Museum, whose source was opened in March 2024. The main repo, ente-io/ente on GitHub, holds roughly 29,779 stars and 1,884 forks under AGPL-3.0, with a monorepo spanning web apps, a Flutter mobile app, Electron desktop apps, the Go-based Museum server, a shared Rust crypto core, and a Go CLI.

Ente Cloud vs Self-Hosted: Which Should You Choose?

Choose Ente Cloud if you want encryption with zero maintenance: install the app, sign up, back up. Choose self-hosting if you want to hold the server side of the bargain too — the photos stay end-to-end encrypted either way, because encryption happens on your device, not on the server.

For a real photo library, self-hosting is only cheaper once you are past roughly the 200 GB mark, because object storage and a small VPS cost more than the $59.88/year 200 GB tier — at that point Ente becomes a true self-hosted Google Photos alternative on your own terms. Beginners should start on the free cloud tier, learn the recovery-key lesson below, and only self-host when the why is concrete.

Step 0: Create Your Account and Save the Recovery Key

Your account setup takes five minutes, and the recovery key is the load-bearing part of the whole product. When you create your account, Ente generates a 24-word recovery phrase. Ente's security FAQ states plainly that support cannot provide or regenerate this key, and that Ente never has access to it or to your encrypted data — that is what zero-knowledge means in practice.

If you forget your password while you are still logged in on a device, you can reset it normally. If you forget your password and are logged out everywhere, only the recovery key gets you back — unless you previously set up Legacy recovery, which lets a designated contact help. The same recovery key covers Photos, Auth, and Locker on one account, and it cannot be rotated for an existing account.

One more trap, straight from Ente's post-install docs: an account on your own server is a different account from your Ente Cloud account even if you use the same email address — separate password, separate recovery key, separate data. Signing up on a new server does not move or link anything. Keep a separate password-manager entry labeled with the server address.

How to Deploy Your Own Ente Server

The recommended path is the quickstart script, not the manual build. On a Linux machine with Docker — a cheap VPS works; read what is VPS hosting if you have never rented one — run the one-liner from Ente's self-hosting docs:

sh -c "$(curl -fsSL https://raw.githubusercontent.com/ente-io/ente/main/server/quickstart.sh)"

The script creates a my-ente directory, pulls the containers, and starts everything. The Photos web app lands at http://localhost:3000 and the Museum API on port 8080. Inspect the script before you pipe it into a shell — that habit will serve you on every self-hosted project, not just this one.

Only real gotcha at this stage: on a remote VPS, localhost:3000 is the server's own loopback, not yours. Bind or proxy it to something reachable (a reverse proxy with TLS is the grown-up answer — our Caddy beginner guide covers the easy path), and never expose the setup wizard to the open internet without a password on it.

Configure S3 Storage for a Real Library

The quickstart ships with MinIO, a local S3-compatible store, which is perfect for testing and wrong for a real library. Production storage is configured in museum.yaml with per-bucket keys for endpoint, region, bucket name, key, and secret — Ente's docs name three bucket roles (hot, warm, cold) and note that replication across them is disabled until you configure all three and flip replication.enabled to true.

The docs state one rule that bites every beginner: the client and the server must reach your S3 endpoint at the same address. The default MinIO endpoint (localhost:3200) works from the server but fails from your phone, because your phone's "localhost" is itself. For anything beyond a test drive, use a real S3 provider (Cloudflare R2 and Backblaze B2 are the common picks) with an address both sides can resolve.

The 7-Taps Rule: Pointing Your Apps at Your Own Server

Ente's apps default to Ente Cloud, and the switch to your server is hidden in a developer gesture: tap the onboarding screen 7 times on mobile to open the developer settings and enter your server endpoint; on desktop, tap 7 times on the onboarding screen to configure the server endpoint directly. This is current, documented behavior in Ente's post-install docs — not a hack.

Prefer the terminal? The official CLI does the same thing in one command:

ente account login --account home-server --app photos --host https://api.example.org

After pointing the app at your server, create your account there — remembering the separate-account rule from Step 0 — and save that server's recovery key as its own entry. You now have two Ente universes that happen to share your email address and nothing else.

Your First 10 Minutes with Ente

This is the whole beginner arc in one numbered pass. Do it in order; each step assumes the last.

1. Install the app — Ente Photos on iOS or Android, the desktop app, or web.ente.io for cloud users.
2. Create your account — cloud users sign up in-app; self-hosters point at their server first (the 7-taps rule) and then sign up.
3. Save the 24-word recovery key — write it on paper and put it in your password manager. Do not screenshot it into your camera roll; that is the roll you are about to encrypt.
4. Grant photo access — full-library access on the phone, or point the desktop app at a folder.
5. Start the first backup — one album first, not the whole library, so you can watch the upload speed and battery behavior.
6. Verify on another device — log in on the web app and confirm the album decrypts there. This proves your key works.
7. Turn on the remaining albums — now back up everything, ideally on Wi-Fi and a charger.
8. Try search — face recognition and on-device search run locally; confirm your people clusters appear.
9. Share one album — create a public link and open it in a private browser window to see what recipients see.
10. Set up Ente Auth — move your two-factor codes into the free Auth app so your second factor enjoys the same encryption.

Albums, Sharing, and Public Links

Sharing is where Ente's cryptography becomes visible. A public link can be opened by anyone without an Ente account or the app; the decryption key travels in the URL fragment after the #, which browsers never send to the server — so the server serves ciphertext it cannot read. Optional password protection, expiry dates, and custom domains are available, but note the fine print from Ente's docs: the password is server-side access control, not re-encryption. Recipients can also be invited to add photos to a shared album, and since a 2026 update they can like and comment on shared photos.

For couples and families, the September 2026 Library Sharing feature goes further: you can share your entire library with a partner while it stays end-to-end encrypted, with album keys sealed to the family member's public key rather than ever exposed.

Ente vs Immich vs Google Photos

Pick Ente if your threat model is the cloud provider itself: photos are encrypted on your device, so even Ente's own staff cannot see them, and you can self-host the server without losing that property. Pick Immich if your threat model is convenience and control on your own hardware: Immich keeps photos on your server in readable form and runs its machine learning there — powerful, but anyone with server access can see everything. Pick Google Photos if you want zero setup and accept that Google's systems scan your library to power their features.

Meet Ente Auth, the Free Second Half

Ente Auth is a separate, free, open-source two-factor authenticator for iOS, Android, desktop, and web. Your codes are encrypted on your device before syncing — Ente's servers store only encrypted copies and cannot read them — and an offline mode lets you use it without any backups at all. If you are migrating from another authenticator, Auth supports bulk import, which turns a weekend migration into a ten-minute one. Ente has stated that Auth will stay free.

7 Beginner Mistakes That Cost People Their Photos

Sources

• Ente Help — Self-hosting installation and post-install docs (ente.com/help, including the 7-taps developer-settings gesture and the separate-accounts rule)
• Ente Help — Storage and plans FAQ (10 GB free tier; paid plan lineup and family plans)
• Ente Help — Security FAQ (24-word recovery phrase; zero-knowledge; no key regeneration)
• Ente Help — Public links (URL-fragment key delivery; password as access control)
• Ente Help — Auth FAQ (encrypted sync; offline mode; bulk import)
• Ente Help — Configuring Object Storage (museum.yaml bucket keys; replication)
• Ente Help — Photos changelog (v1.3.67 mobile release, Oct 2026)
• Ente Blog — Library Sharing (Sept 2026, E2EE partner library sharing)
• Ente — Ente vs Immich comparison (last verified Sept 2026)
• GitHub — ente-io/ente (stars, forks, AGPL-3.0 license; monorepo layout via repo analysis)
• privacytools.io — Ente GitHub statistics (daily-synced)
• abhay.app — "How I self-hosted Ente and how you can too" (quickstart.sh arc; R2 as S3 storage)
• wiki.nixos.org — Ente Photos (museum and ente-web packages; 7-taps tip)
• dev.to — 0012303 Ente overview (stale 5 GB figure noted; superseded by official FAQ)
• privacypick — Ente review (plan pricing; Locker quotas)
• selfhost.directory — Ente notes (paid 3x replication; Auth stays free)
• community.ente.io — Getting Started FAQ (Ente Locker onboarding)
• bentasker.co.uk — Ente CLI backup guide
• androidauthority.com — Ente hands-on review
• contabo.com blog — Ente's pure-Rust cryptography layer (April 2026) and Museum open-sourcing (March 2024)
• lemmy.world — Immich-acquired-by-FUTO discussion (migration signal)

Frequently Asked Questions

What happens if I lose my Ente recovery key?

If you are still logged in on any device, change your password from settings and you are safe. If you are logged out everywhere and you lost the 24-word phrase, your photos are gone — Ente's zero-knowledge design means support cannot regenerate the key or decrypt your data. The only exception is Legacy recovery, which you must set up before you need it.

Is Ente really free?

The Photos free tier is 10 GB forever, no credit card. Paid tiers start at $2.99/month for 50 GB and scale to multi-terabyte plans, with family plans covering up to five members on one storage pool. Ente Auth is free, and Ente Locker gives 100 items / 1 GB free, rising with any paid Photos subscription. Dormant free accounts may be deleted after 12 months of no use, with email warnings first.

How do I point the Ente app at my self-hosted server?

On mobile, tap the onboarding screen 7 times to open developer settings and enter your server endpoint; on desktop, tap 7 times on the onboarding screen to configure the endpoint; from the terminal, run ente account login --account home-server --app photos --host https://api.example.org. Then create your account on that server — it is separate from any Ente Cloud account even with the same email.

Ente vs Immich — which should I choose?

Choose Ente if you want end-to-end encryption, including the option of a managed cloud tier where the operator cannot see your photos. Choose Immich if you want maximum self-hosted control with server-side machine learning and do not mind the server storing photos unencrypted. They are different products for different threat models, not rivals.

Can I use my own S3 storage with a self-hosted Ente server?

Yes — configure the buckets in museum.yaml with endpoint, region, bucket, key, and secret, then enable replication once all three bucket roles are set. The critical rule: your phone and the server must reach the S3 endpoint at the same address, so the default MinIO localhost:3200 only works for testing from the server itself.