<p>CryptPad is the <strong>zero knowledge</strong> realtime collaborative editor.
<p>CryptPad is the <strong>zero knowledge</strong> realtime collaborative editor.
Encryption carried out in your web browser protects the data from the server, the cloud
Encryption carried out in your web browser protects the data from the server, the cloud
and the NSA. This project uses the <ahref="http://ckeditor.com/">CKEditor</a> Visual Editor and the <ahref="https://github.com/xwiki-contrib/chainpad">ChainPad</a> realtime
and the NSA. This project uses the <ahref="http://ckeditor.com/">CKEditor</a> Visual Editor
engine. The secret key is stored in the URL <ahref="https://en.wikipedia.org/wiki/Fragment_identifier">fragment identifier</a> which is never sent to
the <ahref="https://github.com/xwiki-contrib/chainpad">ChainPad</a> realtime engine and now
the server but is available to javascript so by sharing the URL, you give authorization
<ahref="http://visop-dev.com/Project+jQuery.sheet">jQuery.sheet</a> for realtime spreadsheet
to others who want to participate.</p>
editing! The secret encryption key is stored in the URL
</code></pre><h2id="security">Security</h2>
<ahref="https://en.wikipedia.org/wiki/Fragment_identifier">fragment identifier</a> which is
<p>CryptPad is <em>private</em> not <em>anonymous</em>. Privacy protects your data, anonymity protects you.
never sent to the server but is available to javascript so by sharing the URL, you give
As such, it is possible for a collaborator on the pad to include some silly/ugly/nasty things
authorization to others who want to participate.</p>
in a CryptPad such as an image which reveals your IP address when your browser automatically
loads it or a script which plays Rick Asleys's greatest hits. It is acceptable for anyone
</code></pre><h2id="howitworks">How It Works</h2>
who does not have the key to be able to change anything in the pad or add anything, even the
<p>The server does have a certain power, it can send you evil javascript which does the wrong
algorithm which is able to find distributed consensus using a Nakamoto Blockchain, a construct
thing (leaks the key or the data back to the server or to someone else). This is however an
popularized by <ahref="https://en.wikipedia.org/wiki/Bitcoin">Bitcoin</a>. This way the
<ahref="https://en.wikipedia.org/wiki/Attack_(computing)#Types_of_attacks">active attack</a> which makes it detectable. The NSA really hates doing these because they might
algorithm can avoid the need for a central server to resolve Operational Transform Edit
get caught and laughed at and humiliated in front of the whole world (again). If you're making
Conflicts and without the need for resolving conflicts, the server can be kept unaware of the
the NSA mad enough for them to use an active attack against you, Great Success Highfive, now take
content which is being edited on the pad.</p>
the battery out of your computer before it spawns Agent Smith.</p>
<p><strong>NOTE</strong> Pads and spreadsheets will be removed after 30 days of inactivity</p>
<center>
<center>
<noscript><strong>OOPS</strong> In order to do encryption in your browser, Javascript is really <strong>really</strong> required.</noscript>
<noscript>
<p>
<strong>OOPS</strong> In order to do encryption in your browser, Javascript is really
<strong>really</strong> required.
</p>
</noscript>
<script>
<script>
require(['/common/crypto.js'], function (Crypto) {
require(['/common/crypto.js'], function (Crypto) {