cryptpad/cryptpad

Collaborative office suite, end-to-end encrypted and open-source.

CryptPad

CryptPad is a collaboration suite that is end-to-end-encrypted and open-source. It is built to enable collaboration, synchronizing changes to documents in real time. Because all data is encrypted, the service and its administrators have no way of seeing the content being edited and stored.

Installation

For development

Our developer guide provides instructions for setting up a local instance without HTTPS or our more advanced security features.

For production

Configuring CryptPad for production requires a little more work, but the process is described in our admin installation guide. From there you can find more information about customization and maintenance.

Current version

The most recent version and all past release notes can be found here.

Setup using Docker

You can find Dockerfile, docker-compose.yml and docker-entrypoint.sh files at the root of this repository. We also publish every release on Docker Hub as AMD64 & ARM64 official images.

Previously, Docker images were community maintained, had their own repository and weren't official supported. We changed that with v5.4.0 during July 2023. Thanks to @promasu for all the work on the community images.

Privacy / Security

CryptPad offers a variety of collaborative tools that encrypt your data in your browser before it is sent to the server and your collaborators. In the event that the server is compromized the database holds encrypted data that is not of much value to attackers.

The code which performs the encryption is still loaded from the host server like any other web page, so you still need to trust the administrator to keep their server secure and to send you the right code. An expert can download code from the server and check that it isn't doing anything malicious like leaking your encryption keys, which is why this is considered an active attack.

The platform is designed to minimize what data is exposed to its operators. User registration and account access is based on a cryptographic key that is derived from your username and password so the server never needs to see either and you don't need to worry about whether they are being stored securely. It is impossible to verify whether a server's operators are logging your IP or other activity, so if you consider this information sensitive it is safest to assume it is being recorded and access your preferred instance via Tor browser.

A correctly configured instance has safeguards to prevent collaborators from doing some nasty things like injecting scripts into collaborative documents or uploads. The project is actively maintained and bugs that our safeguards don't catch tend to get fixed quickly. For this reason it is best to only use instances that are running the most recent version, which is currently on a three-week release cycle. It is difficult for a non-expert to determine whether an instance is otherwise configured correctly, so we are actively working on allowing administrators to opt in to a public directory of servers that meet our strict criteria for safety.

Translations

CryptPad can be translated with nothing more than a web browser via our Weblate instance. See the state of the translated languages:

More information about this can be found in our translation guide.

Contacting Us

The best places to reach the development team and the community are the CryptPad Forum and the Matrix chat

The team is also on the fediverse: @[email protected]

Team

CryptPad is actively developed by a team at XWiki SAS, a company that has been building Open-Source software since 2004 with contributors from around the world. Between 2015 and 2019 it was funded by a research grant from the French state through BPI France. In the years since we have been funded by NLnet PET, NGI TRUST, NGI DAPSI, subscribers of CryptPad.fr, and donations to our Open-Collective campaign.

Contributing

We love Open Source and we love contribution. Learn more about contributing.

If you have any questions or comments, or if you're interested in contributing to CryptPad, come say hi in our Matrix channel.

This project is tested with BrowserStack.

License

This software is and will always be available under the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. If you wish to use this technology in a proprietary product, please contact [email protected]

cryptpad's Issues

Add LaTeX syntax higlighting to code editor

The code editor offers already plenty of options for code highlighting, LaTeX is however not amongst them.

const Crypto = require('crypto'); = SyntaxError: Use of const in strict mode.

Howdy,

I generally try to avoid running nodejs apps whenever possible but wanted to give this one a shot, however this error message is not overly helpful.

Is anyone ale to shed some light on this for me?

• CentOS 7
• Followed 'To install:...'
• npm: 2.15.1
• node: nodejs-0.10.46-1nodesource.el7.centos.x86_64

[nginx@nas]/usr/share/nginx/html/cryptpad% node ./server.js

/usr/share/nginx/html/cryptpad/NetfluxWebsocketSrv.js:2
const Crypto = require('crypto');
^^^^^
SyntaxError: Use of const in strict mode.
    at Module._compile (module.js:439:25)
    at Object.Module._extensions..js (module.js:474:10)
    at Module.load (module.js:356:32)
    at Function.Module._load (module.js:312:12)
    at Module.require (module.js:364:17)
    at require (module.js:380:17)
    at Object.<anonymous> (/usr/share/nginx/html/cryptpad/server.js:9:18)
    at Module._compile (module.js:456:26)
    at Object.Module._extensions..js (module.js:474:10)
    at Module.load (module.js:356:32)

Export to file

Would be nice to export the contents of a pad to a file, for now I'm interested in the code pad, as this does not require special formatting.

Use of phrase "zero knowledge"

Zero knowledge is commonly used to refer to a method of proving knowledge of secret information without revealing it. (https://en.wikipedia.org/wiki/Zero-knowledge, https://www.google.com/#q=zero+knowledge)

I am not seeing how this relates to a collaborative document editor, are you just using the phrase incorrectly? Please elaborate how/why you are using zero-knowledge proofs in this software.

CryptPad stuck at "Loading..." screen

Hey,

I'm running the latest version in a setup like mentioned in issue #84. I'm running it behind a nginx reverse proxy on a https endpoint with the following config:

    location / {
        proxy_pass http://localhost:3010/;
        proxy_set_header    Host $host;
        proxy_set_header    X-Forwarded-Proto https;
        proxy_buffering off;
        autoindex  off;
    }

Something doesn't seem to work as I'm getting the following error messages.

I tried it with the same nginx config as mentioned in this thread: #62 (comment) but that didn't change anything.

location / {
        proxy_pass http://localhost:3010/;
        proxy_set_header    Host $host;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection upgrade;
    }

Any idea what's wrong there?

make localStorage usage configurable

for those whose threat model includes device confiscation and localStorage inspection.

how would I control line height?

So it seems like when I type there is a quite a big space between lines.

yet I can see that text can by typed without so much space -> i just cant figure out how it was done.

http://i.imgur.com/XR4vqyu.png

Recently typed text gets lost when another user joins a document

I just started using cryptpad but I noticed that when a collaborator joins my document the past ~10 seconds of writing get reverted.

Can't open links in View only mode

Links added to the pad cannot be opened or copied from the view only page and can only be modified in editing mode.

In Chrome, when in view only mode you can right click the link while holding CTRL and a "Open in new Tab" option will pop-up.

configurable language for syntax highlighting in code editor

Right now we highlight everything as if it were javascript.

Translations are gone :O

The main page has been updated and with that update all the previously created translations are gone.
I can translate it back to polish (as I did the original), but you'll have to contact others to redo theirs if they want.

Both master and 0.3.0 show the spinner forever

I've tried both 0.3.0 and master with multiple storage engines - when creating a new pad/code editor the spinner shows up and keeps on spinning forever

userPass in sendChannelMessage not defined

This looks wrong https://github.com/cjdelisle/cryptpad/blob/master/ChainPadSrv.js#L71

Running cryptpad as background service

Going through installation guide I've found out that there is no mention of "How to run Cryptpad as background service" or "How to run Cryptpad with nginx/apache".

Running node with screen results in "Cannot GET /" when no address extensions is specified. Accessing pads works flawlessly.

• screen -DmS node /cryptpad/location/server.js

Running node with systemd is a way to go if you want cryptpad as background service accessible on port specified in settings file:

• Add cryptpad.service file to /etc/systemd/system/
• Fill it with:

[Unit]
Description=cryptpad
After=network.target

[Service]
ExecStart=/usr/bin/node /root/of/your/cryptpad/server.js
Restart=always
User=nobody
Group=nobody
Environment=PATH=/usr/bin:/usr/local/bin
Environment=NODE_ENV=production
WorkingDirectory=/root/of/your/cryptpad

[Install]
WantedBy=multi-user.target

• Start the service with:
  systemctl start cryptpad

My school has a very strict firewall.
Access to cryptpad on port 3000 is blocked, so I've thought about proxypass in nginx, but it only forwards you to port 3000 which is blocked anyway.

Make web sockets work behind port forwarding

I'm trying to set up cryptpad (listening at http and websocket on port 3000) behind a nginx reverse proxy that forwards requests sent to e.g. mycryptpad.example.com:80 to 192.168.0.1:3000

It works for static web content.

However, when the web client performs a GET on /api/config, it is told to open a websocket to ws://mycryptpad.example.com:3000, but it should be 80
The relevant code is at server.js line 55

This is hard to rewrite in reverse proxy configuration.

Could you add in config.js an optional parameter with the port to be shown to web clients in case it's different to the listening port?

Thanks so much for your work!

Feature request: Password protection

---

Dockerhub repository 404ing

Looks like the image is not on docker hub any more:

https://www.docker.com/xwiki/cryptpad

decentralized mode?

as far as I understand, cryptpad is still centralized

ServerA
|--- browser1
|--- browser2
|--- browser3

Is there a way to have a decentralization at the server level as follows?

ServerA
|--- browser1
|--- ServerB
        |--- browser2
        |--- browser3

Spell-checker issues on Firefox

Opening cryptpad with Firefox 45.2.0, I can see the spelling mistakes I make but when I right-click on them, instead of the normal FF menu, I get the CKEditor "paste" menu.

IMHO, disabling CKEditor's context menu makes for a much nicer user experience.

History feature?

Hello, thanks for the great project 👍

Is it possible to have an history feature? (It does not seem to have one).

Not sure what happened, but when a second user entered the pad using a mobile device, all the text was lost.
Having a history feature would have provided a way to go back to a previous version, instead of losing all our text.

Thanks a lot!

Feature Request: Chat

First of all: Great Work!
I wonder if its in your roadmap adding chat like other etherpad services.
Cool

Install issues

We want to run an instance of cryptpad for our coop members
We have installed but when we start the app we have a page that has the cryptpad logo but no functionality.

What are the required changes to the config file to run cyptpad in production ?
Is mongo db required ?
How can we change the look and feel if needed ?

Thanks

Update marked lib to avoid potential XSS

Slide can be vulnerable to an XSS attack if the CSP headers are disabled

How to reproduce

• An attacker creates an slide containing a malicious link: [naughty link](javascript:alert('xss'))
• (S)he shares it with a targeted user
• The targeted user clicks on the link
• The payload is executed if CSP headers are disabled

How to fix

Updating the marked library should fix it.

Unable to access via school network

When users visited a link to a Cryptpad, the page stalled with the loading GIF and never displayed content.

is mysql possible?

Just curious.. Awesome project though.

nginx issues

We have crytpad running with proxypass using nginx
When we try to load a pad the service hangs on the loading screen

nginx proxy pass settings are like this

Set the location routing.

location ~ / {

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;

##Use the domain.tld here.
proxy_pass http://150.82.45.137:3500;

}

Test "http://localhost:3000/p" , it dose not work !

After I installed cryptpad successfully , I tested "http://localhost:3000" , It's totally OK !
When I test "http://localhot:3000/p/" , It dose not work . It should create a new pad automatically . It's url dose not change and the page dose not jump automatically .
When I test "https://cryptpad.fr/p" , this page will automatically jump to 'https://cryptpad.fr/p/#CYf/iyq9wBDnJBGLHKXuqv0L' ! This page created a new pad .

So , the question is how can I create a new pad after cryptpad is installed on my computer ?

Add an open source license

Implement user list & user colors

Hi!

Cryptpad is very nice, but one of the features I like from etherpad is that you can see other users when they open the pad and you can have custom colors for each user's modifications.

Do you plan on integrating these two things to cryptpad?

FEATURE REQUEST: Color by author

I see that it's possible to name collaborators, but it doesn't seem that it's currently possible view edits by author. Is that something on the roadmap?

Thanks for this wonderful amazing tool! I have somehow convinced a friend to use it to set me up on a blind date, as an easy way to talk first but arrive with zero-knowledge (ha!)

What should I fill into config.js

Hello again,

For config.js file, and for testing purpose only, what should I fill into this file?

I have MongoDB in my system already

Integrating into Atom text editor?

Thoughts on integrating a plugin for Atom text editor? They have something similar, using collaborative tools like Firepad. The bad thing is that it goes through the Firebase proxy to share the contents. Would be great if you could use something like cryptpad, with a powerful text editor like Atom, but share locally and encrypted. E.g., if you're the same network, you can share the url with your buddy, and then you can point to point share the data/collaborate over encrypted channels.

cryptpad.fr just lost the contents of all pads.

Any pad I created before that I go to now shows the default startup state, none of my content is there. What happened?

Consider enhancement to support sandstorm.io deployments

Great job XWiki team! A very nice app.

I would like to propose the Sandstorm platform as an excellent option for hosting (and self-hosting) CryptPad.

Many successful collaboration applications are already available within the Sandstorm App Market, the distribution channel is growing every week, and it seems that Sandstorm would be a perfect fit for hosting (or self-hosting) instances of CryptPad applications/documents.

My initial experiment with bundling CryptPad as a Sandstorm app is available on the sandstorm-master branch of my fork. (Edit: see the sandstorm-soon branch for the latest.) See .sandstorm/README.md for more information.

Currently, I am troubleshooting some WebSocket connection issues. All of the CryptPad apps launch and load. However, the UI freezes with a WebSocket connection failure message in the JS console. I do plan to submit a PR, once this issue is resolved.

Document occasionally fails to re-sync when using LevelDB

Looks like we got a race condition kids!

feature request: picture upload

Is it possible to upload automatically pictures and store them on the server encrypted?
Maybe automatically resized and a max size of xx.kb
In some documents it would be really usefull.

... Just my two Cents ;)

Typo in README?

I'm confused by this sentence in the README (under Security):

It is acceptable for anyone who does not have the key to be able to change anything in the pad or add anything, even the server.

Isn't the whole pad encrypted, making it impossible for anyone without the key to make changes?

garbage collection in storage

Cryptpad.fr states:

NOTE Pads and spreadsheets will be removed after 30 days of inactivity

In actuality, once messages are stored in a channel, they remain until someone manually removes that part of the database. It's only the link to the pad which exists in a browser's localStorage which is cleaned up after 30 days.

It might be nice to add a 'deleteChannel' method to the storage API, such that after some amount of time the channel would get removed. Of course, this would have to be configurable.

WDYT?

Conflicting edition

On our deployment of cryptpad, there's a glitch with the cursors being confused when more than one person are editing at the same time: this results in conflicting editions where letters are sent to the wrong line, erasure removes letters from another line, etc.

This may be related to #42, however I'd like to know if other people bumped into this, and if there's a way to work around it. What information would help to debug? (I didn't make the installation, so I need to delegate the replies.)

Option to add collaborations to Bookmarks ?

How to reset Cryptpad server

Hello

After a period of time of usage, how can I reset Cryptpad server (to remove all document written before) and start Cryptpad as clean copy?

Thank you very much

Translations to other languages ?

Mandarin and Spanish at least?

command line tool to get the content of a document

Is there a command line tool to get the content of a document (outside a browser)?

error causes server to die

istening on port 3000
DB connected
[VDThbt+cgFs=:y] registered
[8QxSQ/FfUH8=:y] registered
Removing [8QxSQ/FfUH8=] from channel [u73giBH2D2]
Removing [VDThbt+cgFs=] from channel [u73giBH2D2]
Removing empty channel [u73giBH2D2]
[7T1mGr/H3H4=:y] registered
[7T1mGr/H3H4=:y] registered
[7T1mGr/H3H4=:y] registered
[7T1mGr/H3H4=:y] registered
[7T1mGr/H3H4=:y] registered
[7T1mGr/H3H4=:y] registered
[7T1mGr/H3H4=:y] registered
[xBcR2xfzpLw=:y] registered
Removing [xBcR2xfzpLw=] from channel [u73giBH2D2]
Removing [7T1mGr/H3H4=] from channel [u73giBH2D2]
Error: not opened
at WebSocket.send (/home/luser/cryptpad/node_modules/ws/lib/WebSocket.js:181:16)
at sendMsg (/home/luser/cryptpad/ChainPadSrv.js:61:12)
at /home/luser/cryptpad/ChainPadSrv.js:68:17
at Array.forEach (native)
at /home/luser/cryptpad/ChainPadSrv.js:66:17
at /home/luser/cryptpad/Storage.js:29:9
at /home/luser/cryptpad/node_modules/mongodb/lib/collection.js:345:5
at handleCallback (/home/luser/cryptpad/node_modules/mongodb/lib/utils.js:93:12)
at /home/luser/cryptpad/node_modules/mongodb/lib/collection.js:492:5
at /home/luser/cryptpad/node_modules/mongodb/node_modules/mongodb-core/lib/topologies/server.js:754:13

/home/luser/cryptpad/node_modules/mongodb/lib/utils.js:95
process.nextTick(function() { throw err; });
^
ReferenceError: userPass is not defined
at /home/luser/cryptpad/ChainPadSrv.js:71:33
at Array.forEach (native)
at /home/luser/cryptpad/ChainPadSrv.js:66:17
at /home/luser/cryptpad/Storage.js:29:9
at /home/luser/cryptpad/node_modules/mongodb/lib/collection.js:345:5
at handleCallback (/home/luser/cryptpad/node_modules/mongodb/lib/utils.js:93:12)
at /home/luser/cryptpad/node_modules/mongodb/lib/collection.js:492:5
at /home/luser/cryptpad/node_modules/mongodb/node_modules/mongodb-core/lib/topologies/server.js:754:13
at Callbacks.emit (/home/luser/cryptpad/node_modules/mongodb/node_modules/mongodb-core/lib/topologies/server.js:90:3)
at null.messageHandler (/home/luser/cryptpad/node_modules/mongodb/node_modules/mongodb-core/lib/topologies/server.js:219:23)

Consider sharing a Markdown Tutorial link?

Really good and quick one:
http://www.markdowntutorial.com/

Will you consider implementing GitHub-flavored Markdown - task list, table, etc.

Maybe I'm doing something wrong but I can't get task lists or tables in my presentation -
https://guides.github.com/features/mastering-markdown/#GitHub-flavored-markdown

URLs ending with a hyphen cause problems in mails

URLs like

.../pad/#/1/edit/1BR ... LTb-

cause problems as the hyphen at the end is not interpreted as part of the URL by mail clients and someone clicking on the link will therefore be directed to a non-existant pad.

Editing a local file?

Greetings!

Is there a way to use Cryptpad to collaboratively edit a file on the server?

Thanks!

reference link definitions only work for one slide

When creating slides, references for links are only defined for a single slide. Example:

[eff]: https://www.eff.org

# Slide 1

[EFF][eff]

---

# Slide two

[EFF][eff]

The first link works, but the second one appears as plaintext of "[EFF][eff]", because the reference is not defined for any slide but the first.

Automatic expiration & removal

Hi - I find this project absolutely amazing.
Would be absolutely lovely if some automatic deletion could be added if user specifies expiration time.