CryptPad

What it's good for#

CryptPad is for writing and planning together without handing your words to anyone. A shared shopping list, the minutes of a club meeting, a sign-up form for a street party, a kanban board for a house move: you make a document, share its link, and everyone with the link can edit it at the same time.

What sets it apart is where the encryption happens. Your browser encrypts each document with a key that lives in the link and in your account, and the server only ever stores the scrambled result. Whoever runs the server, you included, can't read it. That makes it a good fit for a server you share with others, or one on a VPS you rent.

LibrePortal installs CryptPad's own tools: rich text documents, code and Markdown, slides, forms, kanban boards, whiteboards, diagrams, calendars and a drive to keep it all in. CryptPad's spreadsheet, document and presentation editors come from OnlyOffice and are an optional extra that LibrePortal doesn't download, so those three aren't there.

Its address#

CryptPad only works on the address it was set up with, and turns everything else away with a blank page. LibrePortal works that address out for you, so there's nothing to choose, but it helps to know which you'll get:

• With a domain and Traefik running, CryptPad takes https://pad.example.com, plus pad-sandbox.example.com for its editors.
• Without, it uses your server's address on your network and the app's two ports, like http://192.168.1.50:5123.

The second address, the sandbox, is a safety measure of CryptPad's. Its editors load from a different address to the one that holds your account, so a bug in an editor can't reach your keys. You never open it yourself.

If you add a domain or switch HTTPS on later, LibrePortal notices the next time CryptPad starts and moves it to the new address. Your documents don't depend on the address, but links you've already shared still name the old one.

Becoming the admin#

CryptPad has no admin password for LibrePortal to make. Accounts are keys worked out in your browser from your username and password, which the server never sees, so nobody but you can create yours. Instead, a new CryptPad makes a one-off setup link, and whoever opens it first and creates an account becomes the administrator.

The link is long and random, so nobody will guess it, but don't share it before you've used it. If you want someone else as an admin too, have them make an account and add them in CryptPad's admin panel under Users.

Who can use it#

Out of the box, anyone who can reach CryptPad can make an account, and can use it without one too, as a guest whose documents live in their browser. New accounts can never become admins on their own. This is CryptPad's normal way of working, and LibrePortal leaves it that way so you can invite people before you've found your way round the admin panel.

Whether that means the whole internet depends on the choice you made when you installed it. If it's only for your household, make it Private on its Config tab under Network (see Who can reach what). If it's public and you don't want strangers making accounts, close registration in CryptPad's admin panel.

How to use it#

Open it with the Web Interface button. The home page lists the tools; pick one to make a new document. It lands in your CryptDrive, where you can organise things into folders.

To share, use the document's Share button. You choose whether people can edit or only view, and CryptPad gives you a link carrying the key. Anyone with that link can open the document, so send it the way you'd send a key to your front door. People with accounts can also be added as contacts and share through their drives, and teams give a group a shared drive of its own.

Good to know#

• Always use the Open button, or the exact address it opens. Other names for the server, like a local name, load a blank page.
• Over the VPN, your devices reach the server at its VPN address, and only that: the LibrePortal VPN carries nothing else, so the home-network address CryptPad was set up with is out of reach while you're away. To check: confirm on a VPN device whether CryptPad can be used while away from home, without a domain and with one
• Plain http:// works on your own network, because CryptPad does its encryption in its own code. Its built-in check-up page will still recommend HTTPS: on plain HTTP, someone on the network in between could in theory tamper with the code that does the encrypting. At home or over your VPN that's a small risk; for anything reached over the internet, use a domain.
• Backups can't be read without passwords. LibrePortal backs up everything CryptPad keeps (there's no database, only files), but it's all encrypted. A restore brings documents back for people who still know their passwords.
• Updates are automatic within the release LibrePortal has pinned (CryptPad 2026.5.1 today), which only ever means a rebuild of that same release. A newer release in a later LibrePortal reaches new installs only: an installed CryptPad stays on the release it was installed with, and Upgrade won't move it to another one yet.
• One per server. Its two addresses are worked out for the one app called CryptPad, so it can't run as several copies.