Our take
Activeregular commits and releases- Activity
- 71
- Community
- 74
- Issues
- 49
- Pull requests
- 40
+68 stars in the last 30 days
- Merges more pull requests than 79% of the projects we track
- More contributors than 78% of the projects we track
- Slower to merge pull requests than 99% of the projects we track
CryptPad is an actively maintained choice for browser-based collaboration where end-to-end encryption and self-hosting matter, though operators still need to assess server trust and AGPL obligations.
Good fit if
- You need real-time collaborative apps and want document contents encrypted before reaching the server.
- Your team can run and maintain a web service, using Node.js or the provided Docker setup.
- You want an actively developed project with regular releases and contributions from a broad contributor base.
Look elsewhere if
- You need a service whose administrators cannot observe any user activity, since the README cautions that IP addresses and other activity may be logged.
- Your deployment cannot meet the project’s production configuration and maintenance requirements.
- AGPL-3.0-or-later does not suit your distribution or product licensing needs.
All health signals
| Last commit | 2026-10-28 (2 days ago) |
|---|---|
| Commits, last 90 days | 100+ |
| Releases, last 12 months | 6 (latest 2026.10.0, 2026-10-21) |
| Contributors | 100+ (top contributor: 60% of commits) |
| Issues closed, last 90 days | 19+ (typically closed in 119 days) |
| Pull requests merged, last 90 days | 63 (typically merged in 44 days) |
| Project age | 12 years |
Checked on 2026-10-31 with the GitHub API.
Project history
Daily GitHub snapshots since Oct 7, 2026. History covers stars and forks; health signals are not tracked historically.
Stars
8,076Forks
879Change since Nov 13, 2026: +1 stars·0 forks
Overview
CryptPad is an open-source, end-to-end encrypted collaboration suite for synchronizing changes to documents in real time. Its browser-based apps let people work together while encrypting data in the browser before it reaches the server or collaborators. The project is written in JavaScript and can be deployed as a self-hosted web service.
It is aimed at teams and individuals who need shared documents but want to limit what the hosting service can read. Encryption does not eliminate the need to trust the server to deliver safe code, and the README notes that instance operators may still log activity such as IP addresses.
Key Features
- Real-time collaboration across a suite of document and productivity apps, including documents, sheets, presentations, forms, Kanban, code, rich text, and whiteboards.
- Encrypts user data in the browser before sending it to the server and collaborators.
- Provides account registration and access based on cryptographic keys derived from a username and password, which the server does not need to see.
- Supports self-hosting, with Docker and Docker Compose files and official AMD64 and ARM64 images.
- Offers browser-based translation through Weblate.
- Includes safeguards intended to prevent malicious script injection through collaborative documents or uploads.
Use Cases
- Teams collaborating on shared documents or spreadsheets who want document contents protected from their hosting provider.
- Organizations that need a self-hosted collaboration suite and can maintain a production instance.
- Groups creating shared forms, Kanban boards, presentations, or whiteboards without relying on separate tools for each activity.
- Users who want to collaborate through a public instance, while choosing a recently updated server and considering what activity metadata may be exposed.
What you need
Detected in the repository
- Node.js (from package.json)
- A Dockerfile, so it can run in a container; a Compose file sets up the related services
- Automated checks on GitHub Actions
License in plain words
AGPL-3.0network copyleft
- Commercial use: yes
- Modify and redistribute: yes
- You must keep: the license notice
- Share your changes: yes, the full source, also when people only use it over a network (e.g. as a hosted service)
- Includes an explicit patent grant from the contributors:
A summary, not legal advice: the LICENSE file is what applies.
Getting Started
For a local development setup, follow the developer setup guide. For a production deployment, use the administrator installation guide. See the README for project details and Docker files.
Alternatives
- officeonline: officeonline enables document editing through Nextcloud and Office Online Server, rather than providing CryptPad’s browser-based, end-to-end encrypted suite.
| Project | Language | License | Stars | Status |
|---|---|---|---|---|
| cryptpad | JavaScript | AGPL-3.0 | 8k | Active |
| officeonline | JavaScript | AGPL-3.0 | 64 | Active |
Considerations
End-to-end encryption protects document contents, but it does not remove the need to trust the instance to serve safe client code. The project describes this as a possible active attack and recommends using recently updated instances; operators also need to configure and maintain production deployments carefully. The measured project activity is current, with recent commits and releases, and contributor activity is not concentrated in one person. The repository is licensed under AGPL-3.0-or-later, which teams should review before incorporating or modifying it.
Found this useful?
Share it with someone who would like cryptpad.