How to Password-Protect an Image (Free, Works in Any Browser)

What does "password-protecting an image" actually mean?

Unlike file-level encryption (where you encrypt the whole file and the recipient needs a password just to open it), region-based password protection lets you share the image normally while specific areas remain hidden. The recipient sees the full image with masked zones. They click a masked area, enter the password, and the hidden content is revealed — right in their browser, without downloading anything.

Practical use cases

• Share a contract with only the price redacted — reveal it only to the signing party.
• Send a screenshot of credentials — blur the password field and share the key separately.
• Post a photo of a receipt on a shared drive — hide the card number.
• Share a document mockup with a client — hide the final copy until approved.
• Send a photo ID for verification — mask the ID number and reveal only to the verifier.

How to password-protect an image (step by step)

1. 1Open safekit.pro — no account or download needed.
2. 2Drop your image or click "Start Locking" to upload it.
3. 3Draw a selection box over the region you want to protect.
4. 4Pick a mask style: Blur, Pixelate, or Black Bar.
5. 5Type a password for this region. You can use a different password for each region.
6. 6Add more protected regions if needed.
7. 7Export the result. You get a shareable link or downloadable HTML file.
8. 8Send the link and the password separately (e.g. link by email, password by SMS).

Always send the image link and password through different channels. If both are in the same message, anyone who intercepts the message can unlock it.

How is the password stored?

Your password is never stored anywhere. It is used to derive an AES-256 encryption key via PBKDF2 (a password-based key derivation function). The key is used to encrypt the image region, then immediately discarded. When the recipient enters the password, the same derivation process happens in their browser — if the key matches, the region decrypts. There is no database, no account, and no server involved at any point.

What if someone forgets the password?

Because the password is never stored, it cannot be recovered if lost. This is by design — it guarantees that no one (including the developers of SafeKit) can ever unlock your image without the password. Keep a copy of your passwords somewhere safe, like a password manager.

Continue reading