Cloud computing and the increasing popularity of 5G have greatly increased the application of images on Internet of Things (IoT) devices. The storage of images on an untrusted cloud has high security and privacy risks. Several lightweight cryptosystems have been proposed in the literature as appropriate for resource-constrained IoT devices. These existing lightweight cryptosystems are, however, not only at the risk of compromising the integrity and security of the data but also, due to the use of substitution boxes (S-boxes), require more memory space for their implementation. In this paper, a secure lightweight cryptography algorithm, that eliminates the use of an S-box, has been proposed. An algorithm termed Enc, that accepts a block of size n divides the block into L n R bits of equal length and outputs the encrypted block as follows: $E=\left(L⨂R\right)⨁R,$ where $⨂$ and $⨁$ are exclusive-or and concatenation operators, respectively, was created. A hash result, $hasR=SHA256\left(P⨁K\right),$ was obtained, where SHA256, P, and K are the Secure Hash Algorithm (SHA−256), the encryption key, and plain image, respectively. A seed, S, generated from $enchash=Enc\left(hashenc,K\right),$ where hashenc is the first n bits of hasR, was used to generate a random image, Rim. An intermediate image, $intimage=Rim⨂P$, and cipher image, $C=Enc\left(intimage,K\right),$ were obtained. The proposed scheme was evaluated for encryption quality, decryption quality, system sensitivity, and statistical analyses using various security metrics. The results of the evaluation showed that the proposed scheme has excellent encryption and decryption qualities that are very sensitive to changes in both key and plain images, and resistance to various statistical attacks alongside other security attacks. Based on the result of the security evaluation of the proposed cryptosystem termed Hash XOR Permutation (HXP), the study concluded that the security of the cryptography algorithm can still be maintained without the use of a substitution box. Full article