The Encrypted Collaboration Suite
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
customize.dist Merge remote-tracking branch 'origin/weblate' into soon Feb 11, 2019
docs Add port 3001 to docker port mapping Feb 14, 2019
storage add a todo for flat file db atime Jan 28, 2019
www drop unnecessary keys from french translation Feb 12, 2019
.bowerrc Added cryptsheet to cryptpad suite! Jan 29, 2015
.dockerignore Add docker build to travis tests Jan 25, 2018
.env adding docker and docker-compose Dec 29, 2016
.flowconfig Fix flow, which tries reading random .json files, including test file… Dec 8, 2017
.gitignore merge staging Jun 28, 2018
.jshintignore Implement lock mechanisms for spreadsheets Jan 24, 2019
.jshintrc check for invalid typeof checks Dec 5, 2017
.lesshintrc lesshint compliance Jul 18, 2018
.travis.yml Add docker build to travis tests Jan 25, 2018 add release notes for Raccoon (v2.17.0) Feb 11, 2019
Dockerfile Update to node:6-stretch as slim is not available on arm64v8 labels Jan 11, 2019
LICENSE #2 added license Dec 5, 2014
TestSelenium.js Added a test of /login/ Jan 11, 2018
and_so_it_begins.png Compressed images: PNG recompressed pixel identical, JPGs recompresse… Oct 13, 2017
bower.json Update bower.json Feb 11, 2019
check-account-deletion.js Script to check pads to delete when account deletion request Apr 4, 2018
check-accounts.js lint compliance Nov 22, 2017
config.example.js Update CSP for OnlyOffice apps Jan 28, 2019 Update docker start script to bust the cache on each run Jul 16, 2018
cryptofist.png Compressed images: PNG recompressed pixel identical, JPGs recompresse… Oct 13, 2017
delete-inactive.js use mtime instead of atime for expiration May 3, 2018
docker-compose.yml Persist all directories with Docker Dec 15, 2018 refactor docker to support arm32/arm64/amd64 all in one build Jan 11, 2019
expire-channels.js Delete pads after 3 months of inactivity Feb 26, 2018
import add import script so admins can migrate lvl to files Sep 15, 2016
package.json bump version to 2.17.0 Feb 11, 2019
pinned.js Script to check pads to delete when account deletion request Apr 4, 2018
pinneddata.js use mtime instead of atime for expiration May 3, 2018 Update Aug 14, 2018
rpc.js Fix custom limits not applied when adminEmail is set to false Jan 21, 2019
runtests.js We should remove datastore between tests Jan 11, 2018
screenshot.png Compressed images: PNG recompressed pixel identical, JPGs recompresse… Oct 13, 2017
server.js Move fonts to the onlyoffice build Jan 28, 2019

An XWiki Labs Project

CryptPad screenshot

CryptPad is the Zero Knowledge realtime collaborative editor.

Encryption carried out in your web browser protects the data from the server, the cloud and the NSA. It relies on the ChainPad realtime engine.


Installing CryptPad is pretty straightforward. You can read all about it in the installation guide.

It also contains information on keeping your instance of CryptPad up to date.

Current version

The most recent version and all past release notes can be found here.

Setup using Docker

See Cryptpad-Docker and the community wiki's Docker page for details on how to get up-and-running with Cryptpad in Docker.

Setup using Ansible

See Ansible Role for Cryptpad.


CryptPad is private, not anonymous. Privacy protects your data, anonymity protects you. As such, it is possible for a collaborator on the pad to include some silly/ugly/nasty things in a CryptPad such as an image which reveals your IP address when your browser automatically loads it or a script which plays Rick Astleys's greatest hits. It is possible for anyone who does not have the key to be able to change anything in the pad or add anything, even the server, however the clients will notice this because the content hashes in CryptPad will fail to validate.

The server does have a certain power, it can send you evil javascript which does the wrong thing (leaks the key or the data back to the server or to someone else). This is however an active attack which makes it detectable. The NSA really hates doing these because they might get caught and laughed at and humiliated in front of the whole world (again). If you're making the NSA mad enough for them to use an active attack against you, Great Success Highfive, now take the battery out of your computer before it spawns Agent Smith.

Still there are other low-lives in the world so using CryptPad over HTTPS is probably a good idea.


We'd like to make it easy for more people to use encryption in their routine activities. As such, we've tried to make language-specific parts of CryptPad translatable. If you're able to translate CryptPad's interface, and would like to help, please contact us!

You can also see our translation guide.

Contacting Us

You can reach members of the CryptPad development team on Twitter, via our GitHub issue tracker, on our Matrix channel, or by e-mail.


We love Open Source and we love contribution. It is our intent to keep this project available under the AGPL license forever but in order to finance more development on this and other FOSS projects, we also wish to sell other licenses to this software. Before making a pull request, please read and sign the Commons Management Agreement.

If you have any questions or comments, or if you're interested in contributing to Cryptpad, come say hi on IRC, #cryptpad on Freenode.


AGPL logo

This software is and will always be available under the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. If you wish to use this technology in a proprietary product, please contact