diff --git a/TODO.md b/TODO.md
index ac2a6720..1318a17d 100644
--- a/TODO.md
+++ b/TODO.md
@@ -52,22 +52,21 @@
 - Leave box button focus
 
 - two upload delegates height bug
-- Messed up message delegates position
-
 - Pausing uploads doesn't work well, servers end up dropping the connection 
 - Pause upload, switch to other room, then come back, wrong state displayed
 
-- `code` not colored in room subtitle
-- In the "Leave me" room, "join > Hi > left" aren't combined
+- Messed up message delegates position
 - Event delegates changing height don't scroll the list
+
+- In the "Leave me" room, "join > Hi > left" aren't combined
 - When selecting text and scrolling up, selection stops working after a while
   - Ensure all the text that should be copied is copied
   - Multiple messages are currently copied out of order
 
 - Pressing backspace in composer sometimes doesn't work
-- Message order isn't preserved when sending a first message in a E2E
-  room, then while keys are being shared sending one with another account,
-  then sending one with the first account again
+
+- `code` not colored in room subtitle
+- Quote links color in room subtitles (e.g. "> http://foo.orgA)" )
 
 - If account not in config anymore, discard ui state last page on startup
 - Do something when access token is invalid
@@ -75,7 +74,6 @@
 - Don't store states in delegates
 - [hr not working](https://bugreports.qt.io/browse/QTBUG-74342)
 - Terrible performance using `QT_QPA_PLATFORM=wayland-egl`, must use `xcb`
-- Quote links color in room subtitles (e.g. "> http://foo.orgA)" )
 
 ## Interface
 
@@ -194,6 +192,7 @@
 
 ## Nio contributions
 
+- Streaming download & decrypt
 - Running blocking DB function calls in executor (WIP)
 - `AsyncClient.share_group_session`: send device batches concurrently (WIP)
 
diff --git a/src/python/media_cache.py b/src/python/media_cache.py
index 69730290..3ed4baf6 100644
--- a/src/python/media_cache.py
+++ b/src/python/media_cache.py
@@ -209,6 +209,8 @@ class Thumbnail(Media):
         parsed = urlparse(self.mxc)
 
         if self.crypt_dict:
+            # Matrix makes encrypted thumbs only available through the download
+            # end-point, not the thumbnail one
             resp = await self.cache.backend.download(
                 server_name = parsed.netloc,
                 media_id    = parsed.path.lstrip("/"),
diff --git a/src/qml/Chat/Timeline/EventImage.qml b/src/qml/Chat/Timeline/EventImage.qml
index 081de30c..919653b9 100644
--- a/src/qml/Chat/Timeline/EventImage.qml
+++ b/src/qml/Chat/Timeline/EventImage.qml
@@ -6,8 +6,8 @@ HMxcImage {
     id: image
     width: fitSize.width
     height: fitSize.height
-
     horizontalAlignment: Image.AlignLeft
+
     animated: loader.singleMediaInfo.media_mime === "image/gif" ||
               Utils.urlExtension(loader.mediaUrl) === "gif"
     thumbnail: ! animated && loader.thumbnailMxc
@@ -20,6 +20,8 @@ HMxcImage {
 
 
     property EventMediaLoader loader
+    property bool downloaded: false
+
     readonly property bool isEncrypted: ! Utils.isEmptyObject(cryptDict)
 
     readonly property real maxHeight:
@@ -54,7 +56,24 @@ HMxcImage {
     )
 
 
+    function download(callback) {
+        if (! downloaded) print("Downloading " + loader.mediaUrl + " ...")
+
+        const args = [loader.mediaUrl, loader.singleMediaInfo.media_crypt_dict]
+
+        py.callCoro("media_cache.get_media", args, path => {
+            if (! downloaded) print("Done: " + path)
+            downloaded = true
+            callback(path)
+        })
+    }
+
     function getOpenUrl(callback) {
+        if (image.isEncrypted && loader.mediaUrl) {
+            download(callback)
+            return
+        }
+
         if (image.isEncrypted) {
             callback(image.cachedPath)
             return
@@ -77,14 +96,22 @@ HMxcImage {
     HoverHandler {
         id: hover
         onHoveredChanged: {
-            if (hovered) {
-                getOpenUrl(url => {
-                    eventDelegate.hoveredMediaTypeUrl =
-                        [EventDelegate.Media.Image, url]
-                })
-            } else {
+            if (! hovered) {
                 eventDelegate.hoveredMediaTypeUrl = []
+                return
             }
+
+            if (image.isEncrypted && ! downloaded) {
+                eventDelegate.hoveredMediaTypeUrl =
+                    [EventDelegate.Media.Image, loader.mediaUrl]
+
+                return
+            }
+
+            getOpenUrl(url => {
+                eventDelegate.hoveredMediaTypeUrl =
+                    [EventDelegate.Media.Image, url]
+            })
         }
     }