How to Back Up Android Photos to an Encrypted Archive Using Termux and OpenSSL (No Root)

Backing up photos is easy, but keeping them private is another story. By creating an encrypted archive you protect your memories from accidental exposure, theft, or loss of the backup media. This tutorial shows how to use the free Termux terminal app together with OpenSSL to produce a single, password‑protected archive of every picture stored on your device – all without rooting.

Before you start

• Charge your phone to at least 60 % – the process can take several minutes and you don’t want it to die midway.
• Connect to a stable Wi‑Fi network. The tutorial downloads packages (≈ 30 MB) and you’ll be moving many megabytes of photos.
• Ensure you have enough free storage for a temporary copy of the photos and the final encrypted file. A safe rule is to have at least 2 × the size of your photo library available.
• Write down the encryption password in a secure place. If you forget it, the archive is unrecoverable.

Step 1 – Install Termux and grant storage access

1. Open the Google Play Store (or F-Droid) and install Termux.
2. Launch Termux. The first run will set up the environment – wait for the prompt $.
3. Run the storage permission command:

   termux-setup-storage

   This creates a ~/storage directory with symlinks to ~/storage/shared (your shared internal storage) and ~/storage/downloads.
4. If you see a pop‑up asking for permission, tap Allow.

Step 2 – Install the required packages

Termux ships with its own package manager (pkg) that pulls binaries compiled for Android’s ARM/ARM64 architecture.

1. Update the package list and upgrade existing packages:

   pkg update && pkg upgrade -y

2. Install openssl (for encryption) and tar (for archiving):

   pkg install -y openssl tar

3. Optional but handy: install rsync if you want to copy only new photos in future backups.

   pkg install -y rsync

Step 3 – Locate your photos

Most Android devices store pictures under DCIM/Camera and Pictures folders on the shared storage. Termux accesses them via the ~/storage/shared symlink.

1. Navigate to the shared storage root:

   cd ~/storage/shared

2. Verify the photo directories exist:

   ls -d DCIM Camera Pictures

   If any folder is missing, it simply means you don’t have photos there – the script will skip it.

Step 4 – Create a temporary working directory

We’ll copy all images to a single folder before archiving. This avoids pulling the entire shared tree, keeping the archive size predictable.

mkdir -p ~/photo_backup/tmp

Now copy the images. The command below copies common image formats (jpg, jpeg, png, heic, webp) while preserving the original folder structure.

find DCIM Pictures -type f \( -iname "*.jpg" -o -iname "*.jpeg" -o -iname "*.png" -o -iname "*.heic" -o -iname "*.webp" \) -exec cp --parents {} ~/photo_backup/tmp/ \;

If you have a separate folder for screenshots (Pictures/Screenshots), add it to the find command or run a second find with the same pattern.

Step 5 – Create a tar archive

Now that all photos are gathered in ~/photo_backup/tmp, we compress them into a single .tar file. Compression is optional – the encryption step already adds some overhead.

cd ~/photo_backup
 tar -cvf photos.tar -C tmp .

After the command finishes you’ll see a photos.tar file in ~/photo_backup. Verify its size matches the total size of your copied images.

Step 6 – Encrypt the archive with OpenSSL

OpenSSL’s aes-256-cbc cipher provides strong symmetric encryption. We’ll ask for a password interactively so it never appears in a shell history.

openssl enc -aes-256-cbc -salt -in photos.tar -out photos.tar.enc

When prompted, type a strong password (minimum 12 characters, mix of letters, numbers, symbols). Confirm it. OpenSSL will write photos.tar.enc – the encrypted archive.

Step 7 – Securely delete the unencrypted archive

Even though the photos.tar file resides only in Termux’s private storage, it’s still readable by any app with file‑system access. To reduce risk we overwrite it before deletion.

# Overwrite with random data (size equal to the original file)
 dd if=/dev/urandom of=photos.tar bs=1M count=$(stat -c %s photos.tar) conv=notrunc
 # Remove the file
 rm -f photos.tar

If dd reports “No space left on device”, it means the temporary space is insufficient – increase free storage or split the backup into multiple archives.

Step 8 – Move the encrypted backup to a safe location

At this point you have photos.tar.enc in ~/photo_backup. Copy it to external storage, a computer, or a cloud service you trust. Because the file is encrypted, storing it on an insecure medium does not expose the images.

1. To copy to the primary shared folder (visible in the Gallery app):

   cp photos.tar.enc ~/storage/shared/Backup/

2. Or, connect your phone to a PC via USB and pull the file:

   adb pull /data/data/com.termux/files/home/photo_backup/photos.tar.enc /path/on/pc/

After confirming the copy succeeded, you may delete the Termux folder to reclaim space:

rm -rf ~/photo_backup

Step 9 – Verify the backup (optional but recommended)

Before you consider the job done, test that the encrypted file can be decrypted and that the resulting archive contains the expected photos.

1. Decrypt to a temporary location:

   openssl enc -d -aes-256-cbc -in photos.tar.enc -out test_photos.tar

2. List the contents of the tar file:

   tar -tvf test_photos.tar | head

   You should see a list of image file paths.
3. If the list looks correct, delete the test tar:

   rm -f test_photos.tar

If decryption fails, double‑check the password and ensure the file wasn’t corrupted during transfer.

Automating future backups

Repeating the whole process manually is tedious. You can create a small shell script in Termux that runs the steps you need. Below is a minimal example that you can save as backup_photos.sh and execute with bash backup_photos.sh:

#!/data/data/com.termux/files/usr/bin/bash
set -e
# 1. Prepare temporary folder
TMPDIR=~/photo_backup/tmp
mkdir -p "$TMPDIR"
# 2. Copy new photos (rsync only copies changed files)
rsync -av --include='*/' --include='*.jpg' --include='*.jpeg' --include='*.png' --include='*.heic' --include='*.webp' --exclude='*' ~/storage/shared/DCIM/ "$TMPDIR/"
rsync -av --include='*/' --include='*.jpg' --include='*.jpeg' --include='*.png' --include='*.heic' --include='*.webp' --exclude='*' ~/storage/shared/Pictures/ "$TMPDIR/"
# 3. Create tar
cd ~/photo_backup
tar -cvf photos.tar -C tmp .
# 4. Encrypt (prompt for password)
openssl enc -aes-256-cbc -salt -in photos.tar -out photos.tar.enc
# 5. Securely delete plain tar
dd if=/dev/urandom of=photos.tar bs=1M count=$(stat -c %s photos.tar) conv=notrunc
rm -f photos.tar
# 6. Cleanup
rm -rf "$TMPDIR"

echo "Backup complete: $(date)"

Make the script executable with chmod +x backup_photos.sh. Run it whenever you want a fresh encrypted snapshot.

Troubleshooting common issues

• "command not found: openssl" – The openssl package may have failed to install. Retry pkg install openssl and watch for error messages.
• Insufficient storage – The temporary folder duplicates every photo, doubling the required space. Free up internal storage or move the temporary directory to an SD card by creating a symlink: ln -s /storage/XXXX-XXXX/photo_backup ~/photo_backup.
• Decryption reports "bad decrypt" – Usually caused by an incorrect password or a corrupted file. Verify the file size matches the original encrypted file and re‑enter the password carefully.
• Permission denied when accessing ~/storage/shared – Ensure you ran termux-setup-storage and granted the permission dialog. If the dialog was dismissed, run the command again.

What to do with the encrypted archive

The .tar.enc file can be stored anywhere you like: external SD card, USB‑OTG drive, a NAS, or a cloud backup service. Because it’s encrypted with a strong AES‑256 key, even if the storage medium is lost or stolen the photos remain unreadable.

When you need to restore the images:

1. Copy the .tar.enc file back to the device (or any Linux/Windows machine with OpenSSL).
2. Decrypt:

   openssl enc -d -aes-256-cbc -in photos.tar.enc -out photos.tar

3. Extract:

   tar -xvf photos.tar -C ~/storage/shared/RestoredPhotos

After extraction you can delete the intermediate photos.tar if you wish to keep the archive encrypted.

Wrap‑up

Using Termux and OpenSSL you can create a reliable, password‑protected backup of every photo on your Android device without rooting or third‑party apps. The workflow gives you full control over where the backup lives, how it’s encrypted, and how you verify its integrity. Keep the password safe, test decryption occasionally, and repeat the process whenever you add a substantial number of new pictures.