You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
CryptPad: Client-Side Encrypted Collaboration Suite with European Hosting and Self-Hosting Options
CryptPad is a privacy-first, end-to-end encrypted open-source collaboration platform that combines real-time document editing with zero-knowledge cryptography. Designed as a secure alternative to Google Workspace and Office 365, it offers browser-based productivity tools (docs, spreadsheets, slides, code editors) where all encryption/decryption occurs client-side. Operated since 2018 and self-hostable under AGPLv3 licensing, it combines Proton Drive's privacy philosophy with Notion-like collaborative features.
Architectural Overview
Core Security Model
Component
Implementation
Security Guarantees
Encryption
XChaCha20-Poly1305 for content, Ed25519 for signatures[6][14]
Server never accesses plaintext
Key Management
Derived from user password + per-document secrets stored in #hash URL fragment[6][9]
No server-side key storage
Data Persistence
Encrypted operational transformation logs using Merkle DAG (ChainPad)[6][14]
Conflict resolution without server plaintext access
Sandboxing
Dual-origin architecture separating UI (safe.cryptpad.fr) from crypto ops (cryptpad.fr)[2][10]
XSS mitigation via CSP and iframe isolation
Client Architecture
graph TD
A[Browser Tab] --> B[Shared Worker]
B -->|WebSocket| C[CryptPad Server]
A --> D[Outer Frame: cryptpad.fr]
D --> E[UI Frame: safe.cryptpad.fr]
D --> F[Crypto Frame: unsafe.cryptpad.fr]
Loading
Three-layer isolation ensures:
Worker: Shared WebSocket connection + cache (reduces server load)[10]
Outer Frame: Key management and permission checks
UI Frame: Sandboxed interface without direct crypto access[2]
"Tired of surveillance capitalism? @CryptPad offers Google Docs-like collaboration with true end-to-end encryption. Open-source, self-hostable, and hosted in EU. Your documents stay yours. #PrivacyFirst https://cryptpad.fr"
For Developers:
"Looking for encrypted CRDTs? CryptPad's Merkle DAG implementation shows how to do real-time collaboration without server trust. Check their battle-tested operational transform code: https://github.com/cryptpad/cryptpad"
CryptPad is an open-source, privacy-focused collaboration suite that offers end-to-end encrypted document editing and file sharing, providing a secure alternative to popular cloud-based office tools. According to the project's documentation, CryptPad has been serving users reliably for many years, combining real-time collaboration features with zero-knowledge cryptography to ensure that all content is encrypted and decrypted directly in the user's browser.
Encrypted Self-Hosted Collaboration
CryptPad stands out as a comprehensive client-side encrypted suite, offering functionality similar to Proton Drive while providing the added benefits of being open-source and self-hostable. Unlike many cloud storage solutions, CryptPad ensures that all data is encrypted and decrypted directly in the user's browser, preventing the server from ever accessing plaintext information[1].
This approach aligns CryptPad with privacy-focused services like Proton Drive, which also employs zero-knowledge encryption[2]. However, CryptPad goes a step further by offering a full collaborative office suite, including rich text editors, spreadsheets, and presentation tools, all with real-time collaboration capabilities[1].
The open-source nature of CryptPad provides several advantages:
Transparency: Users can audit the code for security vulnerabilities or backdoors.
Customization: Organizations can modify the software to suit their specific needs.
Self-hosting: Entities can deploy CryptPad on their own infrastructure for complete control.
For those who prefer not to manage their own servers, CryptPad offers a hosted version at cryptpad.fr, providing 1GB of free storage with paid plans for additional space[1]. This flexibility allows users to choose between self-hosting for maximum control or using the hosted version for convenience, similar to how Proton Drive offers both self-hosted and cloud-based options[2].
CryptPad's architecture ensures that even when using the hosted version, the service provider cannot access user data due to the client-side encryption. This is in contrast to many cloud storage providers that have access to user files, making CryptPad a more secure option for sensitive information[1].
The combination of open-source accessibility, self-hosting capabilities, and robust client-side encryption makes CryptPad a compelling alternative to proprietary solutions. It offers the security benefits of services like Proton Drive while providing a broader range of collaborative tools and the flexibility of deployment options[1][3].
CryptPad offers a comprehensive suite of features designed to enhance collaboration while maintaining strict privacy and security standards. Here's an overview of key CryptPad features:
Feature
Description
CryptPad Drive
A secure file storage system for organizing and managing documents[1]
Real-time Editing
Collaborative document editing with end-to-end encryption[1]
Document History
Ability to view and restore previous versions of documents[2]
Safe Links
Prevents accidental exposure of decryption keys in browser address bars[1]
Password Protection
Option to add passwords to documents and folders for extra security[1]
Self-destructing Documents
Create documents with expiration dates or one-time viewing links[1]
Contact Management
Add trusted contacts for secure collaboration[1]
Chat Functionality
Integrated chat system with loadable chat history[1]
2-Factor Authentication
Additional security layer for user accounts[1]
Single Sign-On
Available as a plugin for enterprise integration[1]
Notifications
Alert system for user interactions and updates[1]
CryptPad's features extend beyond basic document editing, offering a rich collaborative environment. The platform supports various document types, including rich text, spreadsheets, presentations, and code editors[3]. All these tools benefit from CryptPad's zero-knowledge encryption system, ensuring that even the service providers cannot access user data[3].
For developers, CryptPad provides a sandboxing architecture that prevents a majority of its code from accessing the encryption keys, enhancing security[4]. This architecture is split into three client-side levels: the outer level (base HTML), a shared worker for connections and caching, and a sandboxed UI frame[5].
CryptPad's commitment to privacy is evident in its use of client-side encryption for all content. This means that documents are encrypted and decrypted directly in the user's browser, with the server never having access to unencrypted data[6]. This approach ensures that even in the event of a server breach, user data remains protected.
For organizations looking to implement CryptPad, it offers both self-hosted and cloud-hosted options. The self-hosted version provides unlimited storage and customization possibilities, while CryptPad Cloud offers managed hosting with additional enterprise features like SLA support and audit logs[7].
By combining these features with its open-source nature, CryptPad positions itself as a robust alternative to mainstream collaboration tools, offering a balance of functionality, security, and privacy that is particularly appealing to privacy-conscious users and organizations handling sensitive information.
The core security model of CryptPad employs XChaCha20-Poly1305 for content encryption and Ed25519 for signatures, ensuring the server never accesses plaintext data[1]. Key management is derived from user passwords and per-document secrets stored in URL fragments, eliminating server-side key storage[2]. The platform utilizes a three-layer client architecture:
A shared worker for WebSocket connections and caching
An outer frame for key management and permission checks
A sandboxed UI frame without direct crypto access
This architecture, combined with a dual-origin setup separating UI (safe.cryptpad.fr) from crypto operations (cryptpad.fr), provides robust XSS mitigation through Content Security Policy and iframe isolation[3][1].
Self-hosting CryptPad offers unlimited storage and customization options, while the hosted version on CryptPad.fr provides 1GB of free storage with paid plans available[1]. Both options ensure zero-knowledge encryption and GDPR compliance. For enterprises, CryptPad Cloud offers managed hosting with additional features like SLA support, SSO integration, and audit logs[2]. Deployment is straightforward using Docker:
Clone the repository: git clone https://github.com/cryptpad/cryptpad
To encourage wider adoption of CryptPad, advocates can share tailored messages on social media platforms. Privacy-focused individuals might appreciate a tweet highlighting CryptPad's end-to-end encryption and European hosting: "Tired of surveillance capitalism? @CryptPad offers Google Docs-like collaboration with true end-to-end encryption. Open-source, self-hostable, and hosted in EU. Your documents stay yours. #PrivacyFirst https://cryptpad.fr"[1]. For developers, emphasizing the technical aspects can be effective: "Looking for encrypted CRDTs? CryptPad's Merkle DAG implementation shows how to do real-time collaboration without server trust. Check their battle-tested operational transform code: https://github.com/cryptpad/cryptpad"[1]. Enterprise users might be swayed by compliance and managed hosting benefits: "GDPR-compliant collaboration without vendor lock-in. @CryptPad Cloud offers managed hosting with SLA, SSO, and audit logs. Ditch surveillance-based productivity tools. https://xwiki.com/en/Blog/get-started-with-cryptpad-cloud/"[1][2].
Client side encrypted OSS Google Drive alternative
I really liked spirit of client side encrypted projects and decided to spread the word.
Searching for proton drive style opensource or hosted alternatives, so collaborate in browser with client-side ancryption?
"Tired of surveillance capitalism? @CryptPad offers Google Docs-like collaboration with true end-to-end encryption. Open-source, self-hostable, and hosted in EU. Your documents stay yours. #PrivacyFirst https://cryptpad.fr "
I like spirit of client side encrypted projects, and decided to generate some writeups and pitches to spread a word!
