Image generation on Halo: peer-to-peer, end-to-end encrypted, stored nowhere
Generate and edit images over Halo's P2P rail. No central servers, no cloud storage — encrypted bytes straight between peers, and you pay per image delivered.
Halo now does images. You can generate images from a prompt and edit an image you upload — over the same peer-to-peer rail that already serves chat. No new accounts, no separate product, and, crucially, no image hosting anywhere in the pipeline.
Every image service you’ve used works the same way: your prompt and your picture go to a company’s servers, the result lands in their storage, and a link to their copy comes back to you. Halo’s image mode is built on the opposite premise — the image only ever exists on the two machines that need it: as bytes in the operator’s memory while it’s being made, as ciphertext while it travels, and as bytes on your device when it arrives.
What shipped
- Text-to-image generation. Pick an image model, write a prompt, get images back — in the app or through the CLI.
- Image editing. Upload a picture, describe the change, and receive the edited result over the same encrypted path.
- Pay per image, in USDC. Flat, per-image pricing from your existing Halo balance. You’re only charged for images actually delivered — a failed or aborted request costs you nothing.
- An OpenAI-compatible API.
halo consumeexposesPOST /v1/images/generationsandPOST /v1/images/editslocally, so existing tools and agents can point at Halo without code changes.
No containers, no blobs, no copies
Most “AI image” products are storage products in disguise. Halo’s image rail was designed so there is nothing to store:
- No cloud buckets, no CDN, no signed URLs. No hop in the pipeline writes the image to disk — not the relay, not a database, not an object store. The relay is a pure in-memory pass-through.
- Straight image encoding between peers. The operator turns the model’s output into raw bytes, encrypts them to your key, and streams the ciphertext through the relay in chunks. Your device reassembles and decrypts them locally. That’s the whole pipeline.
- You never touch a provider link. Operators must deliver inline bytes. If an upstream provider only offers a URL, the operator fetches and inlines it server-side — a link to someone else’s copy of your image never reaches you.
- Ephemeral by default. The result lives in your browser or on your disk because you saved it there — not because a server kept it. There is no “library” sitting in someone’s cloud.
Encrypted for the relay, invisible to it
Requests and results are end-to-end encrypted between you and the operator. The relay that routes traffic between peers forwards ciphertext — it can’t see your prompt, your uploaded image, or the result. And because the relay sits in the middle, the peers stay hidden from each other too: the operator never learns your IP, and you never learn theirs — an arrangement that’s actually more private than a direct peer connection would be.
Privacy extends into the files themselves, in both directions:
- Your upload is scrubbed before it leaves your device. EXIF data — GPS coordinates, camera serial numbers, timestamps — is stripped locally, before encryption. The original file is never sent; if scrubbing fails, nothing is.
- The result is scrubbed before it’s sent back. Generated images often carry embedded metadata from the model provider. The operator strips it before encrypting, so what arrives is pixels — nothing else.
Using it
In the app: open app.runhalo.xyz, pick an image model from the model picker, and prompt. To edit, attach an image alongside your prompt. Pricing is shown per image before you send. New to Halo? Start with use Halo on the web.
From code or an agent: run halo consume and you get local
OpenAI-compatible endpoints — POST /v1/images/generations for generation and
POST /v1/images/edits (multipart: one image + a prompt) for edits. See
consume as a developer.
As an operator: image serving is opt-in and pays per image. Announce the image models you can serve — and, separately, the ones you can edit with — and requests route to you. What to serve and pricing & earnings cover the economics.
FAQ
Is my prompt or image visible to the network? No. Both are end-to-end encrypted to the operator serving your request. The relay only ever handles ciphertext, and stores none of it.
Where is the generated image stored? Nowhere, unless you save it. It’s streamed encrypted to your device and exists only there. No hop in the pipeline persists image bytes.
What do I pay? A flat per-image price in USDC from your Halo balance, shown before you send. You’re only charged for images actually delivered.
Can my existing tools use it?
Yes — halo consume exposes OpenAI-compatible /v1/images/generations and
/v1/images/edits endpoints locally, so anything that speaks that API works.
Does the operator see my picture? The operator serving your request decrypts it in memory to run the model — that’s inherent to inference — but it’s scrubbed of metadata first, never written to disk, and the operator never learns who or where you are.
Images the way the rest of Halo works: peer-to-peer, encrypted in flight, settled per unit of work — and gone from the network the moment they reach you.