Self-hosted, encrypted Google Docs alternative: CryptPad

Google Docs is a marvel of collaborative editing, and it's also a company reading every word you write, storing it on their servers, and folding it into whatever they do with your data. For a shopping list, who cares. For a business plan, a legal draft, a manuscript, or anything you'd rather keep between the people in the document — that's a lot of trust to hand over for the convenience of editing together. CryptPad keeps the collaboration and removes the trust problem: it's a self-hosted office suite where documents are end-to-end encrypted — unreadable even by the server they live on.

What CryptPad is

CryptPad is a full collaborative office suite, comparable in scope to Google's or Microsoft's, but built privacy-first from the ground up. It's not one app — it's a whole drive of them:

• Rich Text documents — the Google Docs equivalent, with real-time co-editing.
• Sheets — spreadsheets, powered by the OnlyOffice engine.
• Presentations and Documents in Office formats.
• Code/Markdown editor with live preview.
• Kanban boards, Whiteboard, Forms, and a Diagram tool.
• A Drive to organize it all, with folders and sharing.

You can open a shared document, watch someone else's cursor move, and edit the same paragraph together — the exact Google Docs magic — except the content is encrypted in your browser before it ever reaches the server.

The one feature that changes everything: encryption

Here's the part that makes CryptPad genuinely different rather than just "another self-hosted docs app." CryptPad is zero-knowledge: encryption and decryption happen in your browser, using keys the server never sees. The document is ciphertext by the time it's stored. That means the server operator — even if that operator is you — cannot read the contents. The keys to a document live in the sharing link itself (after the #), which browsers never send to the server.

The practical upshot is a level of privacy that hosted office suites structurally cannot offer. Google could read your docs if compelled to; a CryptPad server has nothing readable to hand over. For sensitive collaboration — legal, medical, journalistic, commercial — that's not a nice-to-have, it's the whole point.

Why self-host it (when the public instance is already encrypted)?

Fair question — CryptPad's own hosted instance is end-to-end encrypted too. Self-hosting adds:

• Full control and no storage limits. The public instances cap free storage; your own instance's limit is your disk.
• Your own domain and your own instance — for a team or organization, a private CryptPad everyone shares is cleaner than accounts scattered on a public server.
• Defense in depth. The content is already encrypted, but running the server yourself means the metadata, the availability, and the operation are all in your hands too.
• Longevity. Your documents don't depend on someone else keeping a free service running.

Who it's for

• Privacy-sensitive professionals — lawyers, therapists, journalists, researchers — who collaborate on documents that must not sit readable on a third party's servers.
• Teams and organizations that want a shared, self-owned office suite without a per-seat SaaS bill.
• Anyone who simply believes that what they write should be theirs to read, and nobody else's by default.

The honest trade-offs

End-to-end encryption is not free — it buys privacy by giving up things a plaintext-on-the-server app can do, and it's only fair to name them:

• Limited server-side search. The server can't index what it can't read, so finding a phrase across all your documents isn't the instant, everything-at-once experience Google gives you. Organization (folders, tags, titles) matters more here.
• It's a real application. CryptPad is a substantial piece of software — give it reasonable resources, and expect a proper install rather than a single tiny container.
• Recovery is on you. Because the server can't read documents, it also can't "reset" your access the way a normal service can. Keep your account credentials and important share links safe, and back the server up.

None of these are dealbreakers for the audience CryptPad is built for — they're the reasonable cost of documents that are genuinely private. But you should walk in knowing the tool is optimizing for confidentiality first.

How to deploy it

CryptPad runs as a web application behind TLS on a domain, with a volume for its (encrypted) data. TLS is especially important here — the whole security model assumes the browser code arrives untampered. On a VPS it's a real setup and then the standing work of updates and backups; the encryption means backups are safe to store anywhere, since they're ciphertext, but you must have them. Or deploy CryptPad in one click with the app and TLS wired up, and start writing something that's actually private in minutes.

First run

1. Create an account (or use it anonymously for quick pads) and explore the Drive — it's the home for all your documents.
2. Make a Rich Text doc and share the link with a collaborator to feel the real-time editing — then remember that link carries the decryption key, so treat it like the key it is.
3. Set up your team's structure in the Drive with folders and shared spaces if you're running it for a group.
4. Confirm backups of the server's data directory. Encrypted or not, gone is gone.

The bigger picture

CryptPad sits at the intersection of two things worth owning: your documents, and your privacy. If you're replacing Google's suite piece by piece, it pairs naturally with a self-hosted notes and wiki app for your knowledge base and CryptPad for the collaborative, sensitive documents. And if this is your first step into running your own tools, our guide to what self-hosting is and whether it's worth it lays out the lay of the land.

Deploy CryptPad → — or browse the full app catalog of tools you can host and own.