Administration

Open Settings from the gear in the top bar. Every user sees Account, with Signed-in devices inside it, Appearance, and This device, with Layout and Preview rendering inside it, plus Diagnostics in the sidebar. Administrators also get App settings with Users, Models, Editing defaults and Immich instance. Sections stay collapsed until you open them.

Users

Every immich-edit user is an Immich user. They sign in with OAuth, their Immich email and password, or an Immich API key, and immich-edit creates the local account from the Immich user it gets back. It stores no password of its own. Administrator rights follow the user’s Immich administrator flag. OAuth has its own page: OAuth sign-in.

Local edits, history, presets, jobs, and exports are private to each user. Ratings, favorites, tags, and reject marks are shared through Immich.

Under App settings > Users, an administrator can:

• Enable or disable access for another user. Disabling revokes that user’s sessions and cancels active jobs, but keeps their local data.
• Purge another user’s local data: edits, history, presets, exports, and jobs.

Signed-in devices

Account > Signed-in devices lists each browser signed in to your account, with its IP address and when it was last seen. The browser you are using has a this session badge. Revoke session signs one device out, and Revoke all other sessions signs out every device but this one. Signing out of a password or OAuth session also revokes the Immich token behind it.

Appearance

Settings > Appearance sets how immich-edit looks for your account on every device you sign in on:

• Mode: Dark, the default, Light, or System, which follows the device setting.
• Light theme and Dark theme: the theme each mode uses. Built in are immich-edit, Immich, Catppuccin, Rosé Pine, Tokyo Night, Gruvbox, Solarized, Nord, Dracula, One, GitHub and Everforest.
• Light accent and Dark accent: the highlight colour of each mode, picked under its theme from that theme’s colours. The logo and the browser tab icon follow the accent on screen.

The sun and moon button in the top bar switches between light and dark on wider screens. Photos, the editor canvas, scopes, curves and guides drawn on a photo keep neutral colours in every theme, so a theme never changes how a photo looks. Some palette colours are adjusted slightly so text keeps WCAG AA contrast.

This device

Settings > This device holds settings kept in this browser only. Under Layout, Auto picks the touch layout below 768 px wide, or on a touch-first screen whose short side is at most 1100 px. It re-evaluates live when you rotate or resize. Desktop and Touch force one layout for this browser. In the touch layout, menus, dialogs and pickers open as sheets from the bottom of the screen, and dragging a sheet’s handle down closes it. Preview rendering is covered in rendering. Install app adds immich-edit to the Home Screen, Dock or app list; see below.

Install the app

The installed app opens in its own window without browser bars, and uses the same layouts as the browser. Installing needs an HTTPS address with a trusted certificate; on plain http://, Install app says it is unavailable and links to HTTPS for the installed app. The entry is hidden while immich-edit already runs as an installed app.

• Chrome and Edge (desktop and Android): open Settings > This device > Install app and select Install app. The browser asks to confirm. The install icon in the address bar or the browser menu does the same.
• iPhone and iPad: there is no one-tap install, so Install app shows the steps: tap Share in the browser toolbar, choose Add to Home Screen, keep Open as Web App on and tap Add.
• Safari on a Mac: choose File > Add to Dock.
• Other browsers: use Install app or Add to Home screen in the browser menu, where the browser offers it.

Apps installed from Safari on iPhone, iPad and Mac keep their own cookies, so you sign in once more inside the installed app.

When a new version of immich-edit is deployed, the app shows immich-edit was updated with a Reload button. It never reloads by itself. If an edit is still saving or a save failed, Reload waits until the save finishes or you retry it. If you close the message, it comes back the next time the app checks for a new version: when you move between pages and when its window or tab becomes visible again.

Editing defaults

App settings > Editing defaults holds instance-wide defaults for settings an edit leaves unset. They apply to every user.

Automatic lens corrections is on by default: a RAW file with a matching lens profile gets distortion and vignetting correction until someone turns Enable Profile Corrections off for that photo. Turn the setting off to leave those photos uncorrected until someone turns Enable Profile Corrections on. Photos where a user already made that choice keep it either way. Previews, exports, and edited thumbnails pick up the change on their next render.

Immich instance

App settings > Immich instance shows the Immich server immich-edit is bound to, and can rebind it to another one.

Rebinding validates an administrator on the new server, then removes local users, edits, and jobs and rotates the server epoch. Back up DATA_DIR first. The confirmation requires the new hostname. Rebinding takes an email and password or an API key; an OAuth-only administrator creates an Immich API key for it.

Models

AI masks and AI Denoise are optional. Install their models under App settings > Models.

Installs run one at a time and verify a pinned SHA-256 digest. A failed item shows the reason and a Retry action. Cancel download stops a running or queued install and deletes the partial file, so a stalled download no longer holds up the others. Models are shared by all users and stored under DATA_DIR/models.

The catalog covers subject, people, sky, depth, scene, and click selection for masks, plus AI Denoise for RAW photos. The depth model also drives Lens Blur. Check each model’s license before commercial use. Select an installed default when a kind has more than one model.

AI Denoise works on one photo at a time. While it runs it needs roughly 1 GB of RAM for a 24 MP photo, on top of the model itself.

ML_RUNTIME=auto tries WebGPU and falls back to CPU. gpu fails rather than falling back, cpu skips WebGPU, and off disables AI masks and new AI Denoise runs; results that are already stored still apply. On arm64 Linux, inference is CPU-only because the ONNX Runtime distribution has no WebGPU provider for that target.

LUTs, camera profiles, and watermarks

Imported 3D LUTs, DCP camera profiles, and export watermarks are shared by every user, so only an administrator can import or remove them. This happens where they are used, not in Settings:

• Develop > LUT: Import .cube LUT, and Delete LUT for the selected one.
• Develop > Camera Profile: Import .dcp profile, and Delete imported profile for the selected one. Bundled profiles cannot be deleted.
• Export > Watermark: Import PNG watermark, and Delete watermark for the selected one.

All users can browse and apply them. The files live under DATA_DIR/luts, DATA_DIR/dcp, and DATA_DIR/watermarks.

Diagnostics

Settings > Diagnostics is the first place to look when something is slow or broken:

Section	What it shows
Server	Version, Renderer mode, Renderer active, GPU adapter, GPU type on a software rasterizer, Immich connection state and version, and database state
Browser renderer	The Setting, whether this browser draws Previews and the Reason, the measured Browser speed and Server speed, its GPU adapter and GPU limits, and Wasm load and Last render times
Host	OS, CPU model, cores available to the process, and memory with any container limit
HEIF codecs	HEIC and AVIF decode and export support
Render latency	Typical and slow CPU and GPU render times
Render stages, Source frames	Time per pipeline stage, original download and decode times, frame cache hit rate, and requests cut off by the timeout
Render plans	How many renders ran in one pass, in sensor tiles or in output tiles, with the tile edge and count of the last one
Cache usage, GPU memory pools	Frame, raster, and GPU memory use against their limits
Configuration	The effective configuration, with secrets redacted

Check that it worked explains the GPU rows, and previews do not render in the browser lists the browser renderer reasons. Copy support bundle copies these details as one folded block to paste into a Discussion or issue.

Security

• See reverse proxy before exposing the service outside a trusted network.
• Session cookies are HttpOnly and SameSite Strict.
• Per-user Immich credentials are encrypted with DATA_DIR/instance.key.
• Metadata writes require consent in each browser before the first rating, favorite, tag, or reject change.

Report vulnerabilities through GitHub Security Advisories, not a public issue.