Daily Post August 21 2026
Email Us |TEL: 050-1720-0641 | LinkedIn | Daily Posts
| Collaboration | Questions? | Monthly Letter | Monthly Blog | Our Partners |
CryptPad Features
Remember CryptPad processes all encryption and decryption operations locally inside your web browser before any data is saved or transmitted. This is why no administrative staff, third-party hosts, or unauthorized people can ever read your documents, access your files, or track your collaborative activity. today we will talk about the privacy-first tools that are encrypted rich text documents, spreadsheets, code editors, presentation slides, kanban boards, interactive whiteboards, and form builder.
Zero-Knowledge Workspace Design
By design the platform is has a 100% commitment to client-side cryptography and data sovereignty. Traditional web applications process user inputs directly on remote servers, storing plain text in central databases where it remains vulnerable to subpoena, unauthorized inspection, and data breaches. CryptPad subverts this model by treating the host server strictly as a blind, untrusted storage engine. When an operation occurs inside any document, the web browser utilizes local JavaScript execution to wrap the content payload in symmetric encryption using keys generated on the user's local machine. The server only ever receives, stores, and redistributes unintelligible ciphertext streams.
To keep these cryptographic processes from potential web-based attack vectors, the platform has a dual-domain sandboxing model. The primary domain manages key generation, account authentication, and main storage interactions, while the document editing interface is rendered inside an unprivileged sandbox domain isolated through a HTML iframe. This malicious user-generated scripts or cross-site scripting exploits from accessing memory space containing secret encryption keys or session tokens. The encryption key material is encoded directly into URL fragments (the portion of a web link following the hash sign), document access keys are never transmitted over HTTP header requests to the host server, enforcing a mathematically zero-knowledge perimeter.
OnlyOffice vs. Collabora Engine Architecture
To provide features like spreadsheet, document, and presentation features without relying on cloud-side document rendering, CryptPad maintains a custom, modified client-side fork of OnlyOffice. Standard deployments of both OnlyOffice and Collabora Online depend on dedicated web servers running backend document conversion processes. Collabora, in particular, operates entirely through server-side rendering, where a server instance processes document logic, converts document layouts into visual image tiles, and streams those updates to the client and is interpreting remote keystrokes. Because Collabora requires an unencrypted server process to read document contents in memory, integrating it into a zero-knowledge architecture would require engineering effort to strip out server dependencies and adapt the codebase to run entirely within the browser.
To make browser-only processing without a document server, CryptPad developers created a dedicated fork of the OnlyOffice editor engine. They stripped away the required backend server dependencies and modded the code to execute entirely inside the client web browser. Adapting the editor engine to run locally without communicating with a centralized office server, CryptPad preserves complete client-side encryption. The host server acts as a blind relay for encrypted operational sync messages, allowing users to collaborate on rich documents, spreadsheets, and slides without ever transmitting plain text content across the network.
Real-Time Collaborative Rich Text Processing
Keeping concurrent multi-user editing in an encrypted rich text document presents some technical engineering hurdles. In conventional setups, central servers reconcile editing conflicts between multiple authors. CryptPad addresses this by implementing encrypted Operational Transformation and Conflict-free Replicated Data Types natively within the browser client. As a user types, individual character insertions, deletions, and formatting commands are translated into granular atomic operations. These operation units are encrypted locally before being broadcast to peer clients through the central synchronization server.
When other users receive these encrypted payloads, their local client engines execute the corresponding decryption key and apply the operational transformations sequentially to update their local document model. This approach maintains a synchronized document state across dozens of simultaneous writers without ever exposing cleartext to the intermediate network. Rich formatting structures, headings, embedded media, and live cursor tracking operate with minimal latency.
Client-Side Spreadsheets and Computation Engines
Spreadsheet environments carry a higher computational burden than simple text documents due to cell dependency trees, formula evaluation loops, and large grid data structures. In standard cloud architectures, remote servers evaluate cell logic and broadcast calculated outputs globally. CryptPad completely shifts this entire computational workload into the client browser environment through its custom OnlyOffice editor fork, preventing the server from analyzing cell formulas, numeric variables, or financial datasets.
Using client-side calculation engines, every formula, cell value, and formatting attribute is individually or block-encrypted before leaving the local device. When an edit is made to a cell, the local engine updates the local dependency graph, recalculates all affected formulas within browser memory, encrypts the resultant modifications, and broadcasts the encrypted diffs to co-editors. WebAssembly modules are leveraged to handle formula execution and large array processing at near-native execution speeds. As a result, users can perform data modeling, run lookup functions, and organize structured budgets securely, confident that corporate telemetry and financial metrics remain fully obscured from server operators.
Secure Code Editors and Markdown Technical Workspaces
CryptPad incorporates a dedicated code and Markdown workspace used to manage technical text with syntax highlighting, line numbering, and structural rendering and preserving absolute end-to-end security. Raw code files and Markdown documentation are held in client memory as plain text, and all persistent storage operations convert the file contents into encrypted string blocks.
The platform's Markdown editor features a side-by-side real-time preview pane that parses structural markup locally. The server acts as a storage relay for the raw encrypted line changes, completely unaware of whether it is hosting software scripts, API configuration keys, or proprietary system designs. Developers can draft technical specifications, review code blocks, and maintain infrastructure documentation in an environment that mitigates the supply-chain risks associated with centralized, unencrypted cloud code repositories.
Presentation Slides
The slide creation engine in CryptPad treats each presentation as a structured object composed of text frames, vector shapes, layout definitions, and embedded media assets. These elements are serialized into structured data objects and encrypted using symmetric AES payloads before transmission.
Large binary assets, such as high-resolution images or graphic attachments embedded within slides, undergo client-side chunked streaming encryption. Before upload, the browser splits large files into managed blocks, encrypts each block independently with locally generated cryptographic keys, and transfers the encrypted binaries to server-side blob storage. When a collaborator views the presentation, their browser streams the encrypted blocks, reconstructs the decrypted media in local memory, and renders the slides. This design prevents host servers from analyzing visual assets or reading presentation text.
Kanban Boards
Within CryptPad's Kanban module, every element of a project board—including column titles, task descriptions, custom tags, card comments, and assignee metadata is obscured using client-side encryption algorithms.
When a team member creates a card, drags it into a new progress column, or posts an internal comment, the client application packages the positional update into an encrypted state delta. The server receives and stores these encrypted state transitions without ever learning what projects are underway, who is assigned to specific tasks, or what deadlines are approaching. Access control is governed through asymmetric cryptography, where board keys are encrypted specifically for the public signing keys of authorized team members.
Interactive Whiteboards
Traditional real-time streaming architectures rely on the server to process, combine, and smooth these vector movements. CryptPad's interactive whiteboard overcomes this reliance by executing vector calculations and rendering passes strictly on the client side using HTML5 Canvas and SVG technologies.
As a user draws or arranges shapes across the infinite canvas, the client application batches raw coordinate points into compressed byte arrays. These arrays are encrypted instantaneously using symmetric encryption primitives and transmitted over WebSockets. Receiving clients decrypt the coordinate data stream on the fly and paint the vector shapes directly onto the local canvas context.
Forms
Online form builders are typically used to collect sensitive information from external users, including feedback, personal identifiers, job applications, and security reports. Standard web form engines collect responses in plain text databases accessible to server administrators and vulnerable to database breaches. CryptPad solves this structural flaw by utilizing an asymmetric cryptographic workflow that separates form design from submission decryption.
When an administrator creates a new form, their browser generates a public-private key pair locally. The public key is embedded directly into the shareable form link, while the matching private key is stored in the creator's encrypted account storage. When an external respondent submits answers through the form interface, their browser uses the embedded public key to encrypt the submission data client-side before sending it over the network. The database server receives only encrypted blob payloads that it cannot read. Only the form creator, holding the matching private key, can decrypt and inspect the submitted responses after logging into their account.
File Exports and Local Downloads
Downloading or exporting files from a zero-knowledge collaboration suite like CryptPad really alters the mechanics of document conversion, moving the entire workload from remote servers to the user's local machine. Usually on conventional cloud architectures, clicking an export button such as converting a live document to a .docx, .xlsx, or .pdf file triggers a server-side conversion pipeline. The central server opens the plain text document in its own system memory, compiles the binary file structure, and streams the converted document back down to the user. Because CryptPad's host infrastructure holds only unreadable ciphertext and encrypted operational deltas, server-side file conversion is mathematically impossible.
To support local downloads without compromising end-to-end privacy, CryptPad executes all document parsing, binary compilation, and file generation directly inside the client's web browser environment. When a user requests a local download, the browser first retrieves the raw encrypted data from the server and decrypts it in local memory using the session's decryption key. CryptPad's client-side engines such as its modified OnlyOffice browser framework then reconstruct the document tree in RAM and compile the target binary file structure using local system resources.
Once the file structure is assembled in memory, the browser creates a temporary local Blob object using Web APIs and prompts the operating system to save the file to disk. For raw file storage within CryptDrive, such as uploaded images or binary attachments, the browser fetches the encrypted payload, decrypts the binary stream in RAM, and triggers a direct local disk save. At no point during this export process does plain text data, unencrypted media, or converted document structures travel back over the network to the hosting server.
Exporting large spreadsheets or complex presentation decks into native office formats requires temporary bursts of client CPU and RAM utilization. But, this trade-off is needed to keep local downloads strictly private and completely isolated from server-side inspection.
Chat and Messaging Channels
Maintaining real-time chat requires an entirely encrypted communication architecture. CryptPad integrates messaging directly into its document editing interfaces, team drives, and individual contact exchanges, guaranteeing that chat messages get the same client-side cryptographic handling as document text.
When collaborators open a shared document (such as a Rich Text file, Spreadsheet, or Kanban board), the interface provides a built-in side panel for live chat. Message strings entered into this panel are encrypted locally inside the browser using the specific document's symmetric encryption key. The ciphertext is broadcast over WebSockets to connected peers, who decrypt and render the text in their local chat windows. Because the chat payload is bound to the document's secret key, the server sees only unreadable encrypted updates.
For direct user-to-user communications or team-wide channels, CryptPad utilizes an internal mailbox and messaging protocol by public-key cryptography. Each user account generates a public-private key pair when created. Sending a direct message or sharing a document link with a contact, the sender's client encrypts the message payload using the recipient's public key. The server stores the encrypted payload in the recipient's mailbox, where only the recipient holding the corresponding private key can decrypt and read the incoming messages upon logging in.