<p>CryptPad is the <strong>zero knowledge</strong> realtime collaborative editor.
Encryption carried out in your web browser protects the data from the server, the cloud
and the NSA. This project uses the <ahref="http://ckeditor.com/">CKEditor</a> Visual Editor and the <ahref="https://github.com/xwiki-contrib/chainpad">ChainPad</a> realtime
engine. The secret key is stored in the URL <ahref="https://en.wikipedia.org/wiki/Fragment_identifier">fragment identifier</a> which is never sent to
the server but is available to javascript so by sharing the URL, you give authorization
to others who want to participate.</p>
</code></pre><h2id="security">Security</h2>
<p>CryptPad is <em>private</em> not <em>anonymous</em>. Privacy protects your data, anonymity protects you.
As such, it is possible for a collaborator on the pad to include some silly/ugly/nasty things
in a CryptPad such as an image which reveals your IP address when your browser automatically
loads it or a script which plays Rick Asleys's greatest hits. It is acceptable for anyone
who does not have the key to be able to change anything in the pad or add anything, even the
server.</p>
<p>The server does have a certain power, it can send you evil javascript which does the wrong
thing (leaks the key or the data back to the server or to someone else). This is however an
<ahref="https://en.wikipedia.org/wiki/Attack_(computing)#Types_of_attacks">active attack</a> which makes it detectable. The NSA really hates doing these because they might
get caught and laughed at and humiliated in front of the whole world (again). If you're making
the NSA mad enough for them to use an active attack against you, Great Success Highfive, now take
the battery out of your computer before it spawns Agent Smith.</p>
and the NSA. This project uses the <ahref="http://ckeditor.com/">CKEditor</a> Visual Editor
the <ahref="https://github.com/xwiki-contrib/chainpad">ChainPad</a> realtime engine and now
<ahref="http://visop-dev.com/Project+jQuery.sheet">jQuery.sheet</a> for realtime spreadsheet
editing! The secret encryption key is stored in the URL
<ahref="https://en.wikipedia.org/wiki/Fragment_identifier">fragment identifier</a> which is
never sent to the server but is available to javascript so by sharing the URL, you give
authorization to others who want to participate.</p>