English
CryptPad Hosting
Write documents, sheets, and slides together in an end-to-end encrypted collaborative office suite.
No setup fees-
One click deploy -
1 GB RAM Memory needed -
15 GB Disk Space Needed -
From 2 € Price
Tech
- Docker image
- promasu/cryptpad:latest
- Default port
- 3000
How CryptPad works
CryptPad synchronises changes between collaborators while encrypting document content in the browser. The suite includes rich text, spreadsheets, presentations, forms, kanban boards, whiteboards, code and Markdown editors, polls, and a drive for organising access to pads. Sharing links and permissions determine who can open or edit a document.
Its security architecture separates a user-facing interface from the browser context that handles sensitive account and document data. Upstream production documentation uses two different origins: an unsafe main origin and a safe sandbox origin loaded inside an iframe. This separation is part of the isolation model, not merely a cosmetic domain choice.
Key CryptPad features
The catalogue maps both CPAD_MAIN_DOMAIN and CPAD_SANDBOX_DOMAIN to the same application URL. That does not match the two-origin production design documented upstream. The customer-facing copy therefore describes CryptPad’s application capabilities but does not promise the full recommended sandbox isolation for this template.
The catalogue persists CryptPad data and blob directories and does not provision PostgreSQL or MariaDB. Encryption protects document contents from ordinary server-side reading, but metadata, availability, browser security, shared-link handling, passwords, and recovery material still matter. Application email is disabled, so mail-based notices or recovery workflows are not part of the hosted offer.
CryptPad vs Google Workspace
CryptPad provides encrypted browser collaboration with a suite of pad types and a self-hosted data service. Google Workspace is a provider-operated business suite that combines Drive, Docs, Sheets, Slides, Forms, Gmail, Calendar, Meet, Chat, and administrative controls under account-based plans with pooled storage.
Google Workspace may be the better choice for organisations that want maintained native integrations, central user administration, large vendor-managed storage, and a broad collaboration ecosystem. CryptPad is more attractive when browser-side encryption and control of the hosting instance outweigh those managed-service conveniences, provided the deployment follows the required security architecture.
Who uses CryptPad
Project groups use CryptPad for shared notes, planning boards, surveys, spreadsheets, and presentations. Schools and community organisations can collaborate in a browser while reducing readable content on the server, and small teams can organise pads through shared drives and links.
CryptPad is not a drop-in replacement for every desktop office format or Google Workspace integration. Sensitive deployments also require careful domain separation, browser trust, account recovery planning, permissions, and user education about shared links and passwords.
Self-hosting CryptPad: requirements and cost
Workload grows with active editors, open pads, document size, revision activity, blobs, shared drives, simultaneous WebSocket sessions, and browser-side application complexity. The catalogue records PostgreSQL and MariaDB as Not required and persists the CryptPad data and blob directories. Capacity planning should consider both stored encrypted content and collaboration traffic.
On AvaHost, CryptPad uses Plan 1 at €2. The hosted CryptPad package includes one-click deployment, a custom domain with automated HTTPS, automatic application updates, and scheduled backups. The catalogue currently assigns the same URL to the main and sandbox domain variables, whereas upstream production documentation describes separate safe and unsafe origins. AvaHost does not claim that this template reproduces the full recommended isolation model. Application email is disabled, and no Google account migration, office-format guarantee, identity provider, or recovery service is bundled.
F.A.Q
CryptPad starts at €2 on Plan 1. The entry plan fits a small group with modest documents and light simultaneous editing. Active collaborators, open pads, revision traffic, file blobs, shared drives, and document complexity determine when more memory, processing, or storage is appropriate.
The current catalogue maps the main and sandbox domain variables to the same application URL. Upstream production documentation describes two different origins for interface isolation. The hosted page therefore does not promise the full recommended sandbox model, and security-sensitive use should wait for a separately configured sandbox origin.
A custom hostname can be connected with automated HTTPS for the main public address. CryptPad’s upstream architecture also expects a distinct safe sandbox origin, which is a separate requirement from attaching one branded domain. Review both origin values and test editors, sharing, and account workflows before storing confidential material.
Automatic application updates keep the persistent CryptPad data and blob directories attached, and scheduled backups cover the hosted installation. Encrypted content still depends on user passwords, recovery material, browser compatibility, and valid sharing links. Test representative pads and exports after a significant release because the platform cannot decrypt content to validate it for you.