diff --git a/README.md b/README.md
index 59a600f..88b5414 100755
--- a/README.md
+++ b/README.md
@@ -18,6 +18,17 @@ proxy serves them over TLS with auto-renewing certs and no downtime on changes.
 
 **Documentation:** [https://theta42.github.io/proxy/](https://theta42.github.io/proxy/)
 
+## Screenshots
+
+| Hosts | Authentication |
+| --- | --- |
+| ![Host list](docs/images/hosts.png) | ![Per-host SSO auth](docs/images/host-auth-sso.png) |
+
+Basic auth and SSO are mutually exclusive per host, with per-user password
+management once basic auth is enabled:
+
+![Per-host basic auth](docs/images/host-auth-basic.png)
+
 ## Why this over the alternatives
 
 Nginx Proxy Manager, Traefik, and Caddy are all good reverse proxies with
diff --git a/docs/images/host-auth-basic.png b/docs/images/host-auth-basic.png
new file mode 100644
index 0000000..b880082
Binary files /dev/null and b/docs/images/host-auth-basic.png differ
diff --git a/docs/images/host-auth-sso.png b/docs/images/host-auth-sso.png
new file mode 100644
index 0000000..fa05a4f
Binary files /dev/null and b/docs/images/host-auth-sso.png differ
diff --git a/docs/images/hosts.png b/docs/images/hosts.png
new file mode 100644
index 0000000..24b9257
Binary files /dev/null and b/docs/images/hosts.png differ
diff --git a/docs/index.md b/docs/index.md
index 592de3f..2791ce4 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -7,6 +7,17 @@ title: Home
 
 A reverse proxy and HTTPS termination service using OpenResty/nginx with a management API and web GUI.
 
+## Screenshots
+
+| Hosts | Authentication |
+| --- | --- |
+| ![Host list](images/hosts.png) | ![Per-host SSO auth](images/host-auth-sso.png) |
+
+Basic auth and SSO are mutually exclusive per host, with per-user password
+management once basic auth is enabled:
+
+![Per-host basic auth](images/host-auth-basic.png)
+
 ## Features
 
 - **Automated HTTPS/SSL** - Let's Encrypt integration with HTTP-01 and DNS-01 challenges