CryptPad — Private Collaboration in the Browser
General Information
CryptPad looks like just another online office suite at first glance, but it works very differently under the hood. It was designed by a small European team with one clear rule: nobody except the people in the document should ever see its content. That means not the host, not the provider, not even an admin with root access. Everything happens in the browser, and what ends up on the server is just encrypted blobs.
Because of that model, CryptPad quickly caught on with schools, NGOs, and privacy-driven communities. It gives them the basics — docs, sheets, notes, Kanban boards — without dragging in ads, trackers, or hidden analytics.
How It Works
When someone starts a pad, the browser generates a set of keys and keeps them local. Text is encrypted before it leaves the client. The server just stores unreadable data and passes it around between collaborators. Sharing is handled by sending a special link; whoever has the link has the key. If the link is read-only, you can view but not change; if it’s full access, you can edit in real time.
The experience for the user is close to Google Docs: see other people typing, move the cursor around, drop comments. The big difference is that even the hosting provider can’t peek inside.
Functions
Feature | What it looks like in practice
—|—
End-to-end model | Keys stay in the browser; server only stores ciphertext
Editors | Text, Markdown, code pads, spreadsheets, Kanban, polls
Real-time collab | Multi-user editing with live cursors and comments
Sharing | Links carry the keys; rights encoded in the link (view or edit)
Storage | Hosted accounts with quotas; can be self-hosted on Linux
Security | Zero-knowledge design, TLS in transit, no ads or tracking scripts
Platforms | Works in any modern browser on desktop or mobile
Licensing | Open source (AGPL); commercial hosting plans available
Installation Guide (Self-Hosted)
1. Set up a Linux VM with Node.js and MongoDB.
2. Clone the repo from GitHub.
3. Install dependencies with npm install.
4. Adjust config.js for hostname, storage paths, TLS certs.
5. Start it up with node server.js.
6. Point the browser to https://yourdomain and create the first pad.
Admins usually put it behind Nginx or Apache as a reverse proxy to handle HTTPS properly.
Everyday Use
– Teachers and students swap notes or work on assignments without leaking data to big platforms.
– NGOs share sensitive drafts, knowing that the host can’t read them.
– Small teams use it for Kanban boards or planning docs without buying into a large ecosystem.
– Companies sometimes run it internally for projects where confidentiality is non-negotiable.
From the user’s side, it feels ordinary enough — open a doc, type, share a link. The unusual part is that losing the link means losing access; there’s no “reset password” to get data back.
Limitations
Because the server never sees cleartext, you lose server-side search, indexing, or recovery. Collaboration is fast for text, but big spreadsheets or heavy docs can slow down compared to mainstream suites. And the link-based sharing model is simple but unforgiving — if it leaks, so does access.
Comparison
Tool | Platforms | Strengths | Where it fits
—|—|—|—
CryptPad | Browser | Encrypted by default, open source | Privacy-focused teams, education
Google Docs | Browser/mobile | Seamless integration, fast, SaaS model | General productivity
Microsoft 365 | Multi-platform | Enterprise features, Office ecosystem | Corporates, regulated industries
Etherpad | Browser | Simple collaborative text editor | Devs, hackathons, quick notes
Notes from the Field
Admins running CryptPad say the hardest part isn’t setup — it’s teaching users that links are the keys. Lose the link, lose the data. That’s the price of privacy. Once teams accept that trade-off, it becomes a dependable way to collaborate without giving away control.