Unity is Strength - Collaboration is Key - CryptPad is the zero knowledge realtime collaborative editor.
JavaScript CSS HTML Shell
Failed to load latest commit information.
customize.dist implement cache-busting everywhere Feb 17, 2017
storage add a note about installing storage adaptors from npm Oct 20, 2016
www Merge branch 'master' of github.com:xwiki-labs/cryptpad Feb 21, 2017
.bowerrc Added cryptsheet to cryptpad suite! Jan 29, 2015
.dockerignore adding docker and docker-compose Dec 29, 2016
.env adding docker and docker-compose Dec 29, 2016
.gitignore add docker and docker-compose Jan 10, 2017
.jshintignore remove unused files from fs and jshintignore Aug 2, 2016
.jshintrc jshint ignore external code Feb 15, 2016
.travis.yml Run the tests on all of the permanent branches Jan 12, 2017
ARCHITECTURE.md Add a working picture Apr 20, 2016
Dockerfile adding docker and docker-compose Dec 29, 2016
LICENSE #2 added license Dec 5, 2014
NetfluxWebsocketSrv.js fix reference to incorrect config flag Oct 12, 2016
TestSelenium.js Stop doing tests on pull requests because they're always going to fail Jan 12, 2017
and_so_it_begins.png and so it begins Oct 31, 2014
bower.json Pin bower version because cursor handling is broken by the latest ver… Feb 9, 2017
config.js.dist Merge branch 'hpbs' into newtoolbar Jan 30, 2017
container-start.sh adding docker and docker-compose Dec 29, 2016
cryptofist.png now fix the logo again Nov 6, 2014
cryptpad-docker.md adding docker and docker-compose Dec 29, 2016
docker-compose.yml adding docker and docker-compose Dec 29, 2016
import add import script so admins can migrate lvl to files Sep 15, 2016
package.json Improve the homepage with new images and translations Feb 3, 2017
readme.md adding docker and docker-compose Dec 29, 2016
server.js Merge branch 'hpbs' into newtoolbar Jan 30, 2017


XWiki labs logo

Unity is Strength - Collaboration is Key


CryptPad is the zero knowledge realtime collaborative editor. Encryption carried out in your web browser protects the data from the server, the cloud and the NSA. This project uses the CKEditor Visual Editor and the ChainPad realtime engine. The secret key is stored in the URL fragment identifier which is never sent to the server but is available to javascript so by sharing the URL, you give authorization to others who want to participate.


Cryptpad depends on the Nodejs runtime. We recommend installing it via NVM to ensure that you are running an up to date version.

Once you have a recent runtime:

git clone <this repo>
cd cryptpad
npm install
npm install -g bower ## if necessary
bower install

## copy config.js.dist to config.js
cp config.js.dist config.js

## modify configuration to use your own mongodb instance
## for example aon the default mongodb port `mongodb://localhost:27017/demo_database`
$EDITOR config.js

node ./server.js


To get access to the most recent codebase:

cd /your/cryptpad/instance/location;
git pull

To update dependencies:

# clientside dependencies
bower update;

# serverside dependencies
npm update;

To reset your instance of Cryptpad and remove all the data that is being stored:

If you are using the leveldb adaptor, this is as simple as deleting the folder which contains your leveldb datastore:

# change into your cryptpade directory
cd /your/cryptpad/instance/location;

# delete the datastore
rm -rf ./cryptpad.db

If you are using the mongodb adaptor, drop the relevant collection.


To test CryptPad, go to http://your.server:3000/assert/

You can use WebDriver to run this test automatically by running TestSelenium.js but you will need chromedriver installed. If you use Mac, you can brew install chromedriver.

Setup using Docker

See Cryptpad-Docker


CryptPad is private, not anonymous. Privacy protects your data, anonymity protects you. As such, it is possible for a collaborator on the pad to include some silly/ugly/nasty things in a CryptPad such as an image which reveals your IP address when your browser automatically loads it or a script which plays Rick Astleys's greatest hits. It is possible for anyone who does not have the key to be able to change anything in the pad or add anything, even the server, however the clients will notice this because the content hashes in ChainPad will fail to validate.

The server does have a certain power, it can send you evil javascript which does the wrong thing (leaks the key or the data back to the server or to someone else). This is however an active attack which makes it detectable. The NSA really hates doing these because they might get caught and laughed at and humiliated in front of the whole world (again). If you're making the NSA mad enough for them to use an active attack against you, Great Success Highfive, now take the battery out of your computer before it spawns Agent Smith.

Still there are other low-lives in the world so using CryptPad over HTTPS is probably a good idea.


We'd like to make it easy for more people to use encryption in their routine activities. As such, we've tried to make language-specific parts of Cryptpad translatable. If you're able to translate Cryptpad's interface, and would like to help, please contact us!

You can also see our translation guide.

Contacting Us

You can reach members of the Cryptpad development team on twitter, via our github issue tracker, on the freenode irc network, or by email.


We love Open Source and we love contribution. It is our intent to keep this project available under the AGPL license forever but in order to finance more development on this and other FOSS projects, we also wish to sell other licenses to this software. Before making a pull request, please read and sign the Commons Management Agreement.

If you have any questions or comments, or if you're interested in contributing to Cryptpad, come say hi on IRC, #cryptpad on Freenode.


This software is and will always be available under the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. If you wish to use this technology in a proprietary product, please contact sales@xwiki.com