The popularization of intelligent devices including smartphones and surveillance cameras results in more serious privacy issues. De-identiﬁcation is regarded as an effective tool for visual privacy protection with the process of concealing or replacing identity information. Most of the existing de-identiﬁcation methods suffer from some limitations since they mainly focus on the protection process and are usually non-reversible. In this paper, we propose a personalized and invertible de-identiﬁcation method based on the deep generative model, where the main idea is introducing a user-speciﬁc password and an adjustable parameter to control the direction and degree of identity variation. Extensive experiments demonstrate the effectiveness and generalization of our proposed framework for both face de-identiﬁcation and recovery.