Mastofoto

Transform your Mastodon feed into a clean photo-viewing experience.

Mastofoto turns one of your Mastodon lists, or your Home timeline, into a photo-only feed.
It filters out every text-only post, leaving just the pictures shared by the accounts you follow.

Follow the project on Mastodon: @mastofoto@mastodon.uno

🔒 No server, no tracking: Mastofoto talks directly to your Mastodon instance from your browser, and your access token never leaves it. See the Info page for the full picture — how it works, security details, and that it's open source.

📊 This deployment (mastofoto.melandri.net) also runs basic, privacy-friendly analytics via Umami to see approximate visit counts — anonymous page views only, never anything about your Mastodon account or activity.

© 2026 Alessandro Melandri

Version

Mastofoto shows you the posts from one of your Mastodon lists (or your Home timeline), but only the ones that include a photo — every text-only post is filtered out. Connect your account, pick a timeline, and favourite or boost photos right from the feed.

Self hosting

Mastofoto is open source! You can you use it as-is by visiting mastofoto.melandri.net or you can host it yourself on your own server or GitHub Pages: view the source code on GitHub and follow the instructions.

Features

• Log in with any Mastodon instance — no server-side setup required
• Choose which list to follow (with a preview of its members), or use your Home timeline instead
• See only posts containing photos, at full resolution — choose whether boosts are included, in Settings
• Favourite, reblog, and jump to the original post directly from the feed
• A separate Profile view shows just your own photo posts, with your cover photo and an optional hashtag filter
• New posts are highlighted since your last visit
• Click any photo to view it full-size
• Light and dark theme, switchable anytime in Settings
• Installable on your phone's home screen, with pull-to-refresh and offline access to the app itself

Accessibility

• Full keyboard support: photos can be focused and opened (Enter/Space) without a mouse, and the lightbox moves focus to its close button on open and back to the triggering photo on close.
• Screen reader friendly: a proper heading structure, labeled form controls, and live regions so errors and status messages are announced automatically. Photos without an author-provided description get a fallback alt text rather than being silently skipped.
• Color contrast checked against WCAG AA by computing actual contrast ratios for every text/background/border pairing, in both the light and dark theme. The brand blue on the logo is decorative only and never used as text or button-label color for this reason — a separate, verified-accessible blue is used everywhere text appears.
• This hasn't been tested end-to-end with real assistive technology — the above is based on semantic markup and computed contrast, not a full manual audit.

Security & data

• There is no server: Mastofoto is a static page that talks directly to your Mastodon instance from your browser. Nothing you do here is seen or stored by anyone else.
• Your login credentials and access token are stored only in this browser's local storage, kept separate per Mastodon instance, and are cleared when you log out. Your chosen list is remembered even after logging out, ready again next time you sign back in.
• Login uses Mastodon's standard OAuth flow with a random, one-time state value checked on return, so a login started here can't be hijacked or completed with someone else's authorization.
• The app only ever requests permission to read your timeline and to favourite/reblog — it can never post, delete, or follow on your behalf.
• Post content is run through an allowlist filter before being displayed, and only http(s) links are ever made clickable.
• The page is served over HTTPS and sets a Content-Security-Policy restricting where scripts and styles may load from.
• Because there's no backend, the app's own OAuth client credentials are visible in your browser — normal for a purely client-side app like this one, and not something that exposes your account or password.
• A service worker caches only the app's own files, so it still loads without a connection — it never caches or has any access to your Mastodon data.
• Some deployments of Mastofoto (including the maintainer's own) may run basic, privacy-friendly analytics (e.g. Umami) to see approximate visit counts — it only records anonymous page views, nothing about your Mastodon account or activity.

© 2026 Alessandro Melandri