CryptPad

CryptPad is a collaboration suite that encrypts data in the browser before it reaches the server or a collaborator. Changes still synchronize in real time, but stored content stays unreadable, so a breach hands attackers ciphertext rather than documents. Administrators who leave the code unmodified cannot read user content either.

Registration and account access derive cryptographically from your username and password, which means the server never sees either one. The suite spans rich text documents, sheets, presentations, forms, kanban boards, code and whiteboards, all organized in an encrypted drive.

The threat model is stated plainly rather than oversold.

• Active attacks stay possible: encryption code is served by the host, so the administrator still has to be trusted to send honest code.
• Metadata is not hidden: an operator could log addresses and activity, so Tor is suggested for anyone treating that as sensitive.
• Version matters: safeguards against script injection improve on a three-month release cycle, and only recent instances should be used.
• Public directory: instances meeting the project's safety criteria are being listed so users can choose one with confidence.
• Docker images: official AMD64 and ARM64 builds are published for every release.

Installation splits into a developer path without HTTPS and an admin path covering production configuration, customization and maintenance. A team at XWiki SAS develops the project, funded over the years by a French state research grant, NLnet and NGI programs, subscribers and donations, and the software is AGPL licensed for good.