Overview of CryptPad in 2024

Written by

The XWiki Team

2024 has been a special year for CryptPad as it marked 10 years since its first official commit! The team has been hard at work, improving accessibility, boosting mobile performance, refining cloud instances, and enhancing the OnlyOffice integration, among other projects. Let’s take a closer look at the journey so far and what lies ahead for CryptPad.

If you're eager to know what's next, you can also keep an eye on CryptPad's team public Roadmap across the year and on the CryptPad GitHub repository.

Projects & funding
Notable features, improvements & milestones
Spreading the word
Events and media
- 📣 Conferences & talks
- 📰 Press
Partnerships
Our team
What to look forward to in 2025

Projects & funding

We kickstarted 2024 with an analysis of how CryptPad has been funded and what to expect for 2024. For a comparison between our financial expectations and actual results, you can also check out our 2025 analysis.

Here's an overview of the projects we completed last year:

CryptPad AUTH: Signed with NLnet as part of the NGI ASSURE program, this project's goal was to make CryptPad more secure by adding support for external authentication methods. Thus, the CryptPad team worked and delivered the 2-Factor Authentication (2FA), and Single-Sign-On Authentication (SSO), available as a plugin.
CryptPad Blueprints: This is an R&D project thoroughly documenting the use of cryptography in CryptPad, and paving the way towards the "next generation" of the project. A few deliverables that range from documentation to experimental prototypes, but not limited to, have been released by the team in 2024:
- Guide for users on how to use CryptPad in the most secure way;
- Experimental prototypes and/or mockups for future features:
  - Offline first editing with Conflict Free Replicated Data Types (CRDTs);
  - Perfect forward secrecy for a more fine-grained degree of access control e.g., to the document history;
  - Account-recovery mechanism making use of the social secret sharing.

Notable features, improvements & milestones

⛰️ Over 270K accounts on CryptPad.fr

We are happy to report that registered users on our flagship instance have passed the 270,000 mark. This follows a steady growth of about one thousand registrations a week. This growth demonstrates interest in our product, but converting more users into subscribers or donors remains essential for the project's financial sustainability.

📅 Switched from semantic versioning (semver e.g. 5.7.0) to calendar versioning

As CryptPad keeps growing and developing, the accumulation of numbers in versions 5.x.x, 6.x.x, … is starting to feel arbitrary. Instead, we would like to reflect that CryptPad is an ongoing project being actively maintained and improved for the foreseeable future. As a self-hostable service, we believe a date-based version is also a benefit for users as it provides a quick way of checking how up-to-date a particular instance is before using it:

🚀 Release of the Blueprints website

We are happy to announce that we completed the CryptPad Blueprints project and launched our Research & Development website which will be the home for all CryptPad related research going forward. Blueprints is a project funded through NGI Zero Entrust by NLNet to survey the state of the cryptography and the ease of access of CryptPad, and propose some improvements. We already published some of the resources on our blog, such as the whitepaper and a good practices guide. However, these were just a fraction of the full research now accessible on the Blueprints website.

The goal of the website is to show a user-stories based needs analysis and their relations to the proposed solutions (some of which are already live) as well as some prototyping of missing features such as password recovery or the use of the CRDTs to pave the way toward offline-first editing. We will maintain this website and update it when we conduct new research so expect to hear more about Blueprints in the future!

roadmap diagram on the Blueprints website

☁️ CryptPad Cloud demo instances

We are thrilled to announce that you can now test-drive your very own CryptPad instance using our Cloud demo service. This service builds on a similar one by our parent company, XWiki SAS. You can launch demo instances after filling out some basic information, confirm your email to extend the demo to up to 30 days, and finally subscribe if you are happy with the product.

We hope this will encourage bigger actors such as companies and organizations to consider having their own instance managed by us. This is one of the avenues we are exploring to make the project more financially sustainable.

📇 Invitation links and user directory

Instance administrators can now issue invitation links that can be used to create one account each, even if registration is closed on the instance. An optional user directory can help keep track of the known accounts on the instance. This feature is designed for the needs of enterprise customers who use their own instance, hence allowing administrators access to more information than on a public-facing service.

📚 Documentation with a new accessibility section

Alongside documenting new features, we introduced a new accessibility section. The first item in this section is a list of channels to provide accessibility feedback. The list includes a new dedicated chat room in our Matrix space and an email address. We plan to further expand this section with a thorough list of keyboard shortcuts and navigation.

🎛️ Refactored admin panel

We have revamped the administration panel which now uses a more streamlined component system. This should make for more consistent and maintainable styles in that section. We have also reorganized the tabs so that important information about the instance (name, description, etc) is presented first.

🎨 Easily customize instance logo and accent color

You can add a custom logo to a CryptPad instance from the admin panel and change the accent color (used in buttons and many other parts of the CryptPad UI) to match the logo or branding.

We ensure that the color used by default has sufficient contrast with text and background colors in both dark and light themes. Making this customizable will potentially create less accessible color combinations, so administrators should check color contrast before choosing a new color. We will do our best to monitor how this feature is used and potentially add measures such as a contrast-checker in a future version.

🚑🧑‍⚕️ New help-desk system

We completely refactored the support system to make it easier to manage a large history of tickets (serving our own needs on CryptPad.fr). This new version now includes a new moderator role for users that can access the support system without having admin rights on the instance.

📦 New external module for OnlyOffice applications

As you may know, the Spreadsheet, Document, and Presentation applications are integrations of OnlyOffice editors with CryptPad's end-to-end encrypted real-time collaboration. From the integration until April 2024, all 6 versions of OnlyOffice were included in the CryptPad repository. On CryptPad.fr we need to keep all of these versions to support opening documents that our users may have created a long time ago. For newer instances however, it makes little sense to download 1.7GB of OnlyOffice versions that will never be used.

With this version, we are taking the first step in taking the OnlyOffice builds out of the main CryptPad code base to their own repository. We provide an installation script for instance admins to easily install the apps if they want to. While this is "all 6 historical versions or nothing" for now, it is the first step towards a finer-grained system where each instance only downloads the OnlyOffice version currently in use and any subsequent updates.

🧪 End-to-end test suite published

After months of work by Zuzanna on an end-to-end test suite for CryptPad, we are publishing the results on GitHub. This will make our quality assurance process more transparent and might even encourage people with knowledge of Playwright to contribute.

🔛 Onboarding

Screenshot of the first screen of the CryptPad new onboarding process

We added an onboarding process when running CryptPad for the first time to help administrators in the process of configuring their own instance. Once the first admin account is created, the onboarding guides them to configure the name, description, visual identity of the instance, which applications are available, and enable extra security features. All these options can be changed later on in the administration panel.

This will hopefully ease the installation process of new CryptPad instances.

♿ Accessibility

CryptPad is committed to achieving compliance with the Web Content Accessibility Guidelines (WCAG). The development team understands the importance of creating a usable and inclusive experience and is actively working to meet the WCAG 2.1 AA standard. To check on the details and status of this work, please see the Accessibility project on GitHub.

Here are some key accessibility features currently implemented or in progress:

Keyboard navigation: You can access and use interactive elements using only the keyboard.
Focus indicators: Clear and visible focus indicators are present.
Responsive design: We do our best to create interfaces that adapt to various devices and screen sizes.

🛠 Improvements & fixes

This year has been marked by consistent performance optimizations with improvements to the CryptPad server and fixes across the applications, improvements to the 2FA, SSO and user management, as well as to the drive, team, and accessibility.

🧰 Seminar hackathon projects

The annual XWiki seminar always includes a hackathon day for teams to work on things that they would not normally spend time on. Last year, our team worked on the following projects:

Tiptap application prototype

We tested the potential of Tiptap to power our Rich Text application. We are looking for a replacement of the CKEditor which reached end of life in June 2023. We managed a basic integration in one day that allowed to take stock of the work that would be necessary to build this into a full-fledged application.

Remove Bootstrap

Given recent security advisories and the fact that we override most of Bootstrap styles anyway, we wanted to know if we could remove this big dependency from our code base. It turns out that although we don't benefit a lot from Bootstrap features, its styles still cascade to quite a few elements in the CryptPad user interface and would require significant work to remove.

Penpot design system

XWiki now self-hosts Penpot—an open-source alternative to Figma—as an internal tool. Our XWiki colleague Pauline started a design system library to make the creation of future mockups easier.

color swatches in the CryptPad design system made with Penpot

Spreading the word

At CryptPad, we're dedicated to creating a platform that evolves with its users and allows them to collaborate securely. This means that our team works hard to make CryptPad even better by implementing new features, improving the existing ones, sharing useful tips, or contributing to research. Below is a short list of the pieces we've put together in 2024.

🔓 Advocating for open source

📖 Sharing knowledge

🔎 Contributions to cryptographic research

CryptPad is also contributing in theoretical research with papers accepted at Eurocrypt, one of the most reputable conferences in cryptography, hosted by the International Association for Cryptologic Research (IACR), and at the NIST Post-Quantum standardization Conference, hosted by the National Institute of Standards and Technology (NIST). This is the organization leading the current cryptographic efforts toward post-quantum transition.

You can find the full version of this work in the IACR preprint archive and more information is available on the Raccoon signature website. This is the result of the joint effort of Shuichi Katsumata, Mary Maller, Fabrice Mouhartem, Rafael del Pino, Thomas Prest and Markku-Juhani Saarinen.

Events and media

On top of all the work done, and constant improvements brought to CryptPad, the team has also taken part in various talks and conferences.

📣 Conferences & talks

FOSDEM '24 — Fabrice's talk, “Securely collaborate with CryptPad”, gave an overview of CryptPad and showed the results of the nlnet Blueprints project as well as some future directions. 2024 was particularly special because we organized our first meetup after wrapping up our Collab devroom presentations. The evening was filled with vibrant open-source discussions over delicious Belgian beers and some light snacks, and the XWiki and CryptPad communities from across the world, and friends of open source, got the chance to meet in person.
Journées du Logiciel Libre — The event took place in Lyon, and the topic was “Popular education”. That’s why Fabrice's talk about CryptPad for research and education was a great fit. In his presentation, he showed why CryptPad is a tool meant to share information while safeguarding the privacy of both writers and readers. This privacy is guaranteed not only against external threats, but also from us (up to reasonable limits) and our open-source policy ensures that anyone can double-check those claims. The talk was overall well-received and people were glad to discover that CryptPad is more than just an end-to-end encrypted version of Etherpad. You can check the presentation slides for more details.
Pas Sage en Seine — This is a privacy-oriented event that covers a large spectrum of topics. Fabrice gave a general presentation of CryptPad and its recent advances, such as Blueprints or the SSO integration. The public was quite interested, and some people asked for a CryptPad install party to test the server installation process using Docker, which was thus organized. This initiative was a good opportunity to see how easy it is to install CryptPad, and may lead in the future to smoother deployments. The talk was recorded and is available here (in French).
OW2Con — OW2 is a consortium between FOSS actors taking place near Paris to exchange about the new advances in the open-source community. There were also some breakout sessions, with one about Research, Science and Education. It was a great opportunity to have a 15-minute speech about CryptPad for research and education delivered by Fabrice. During those two days, he was also present at the CryptPad booth to answer different questions about CryptPad, its usage and, again, the installation process.
Pass the Salt — This conference with a focus on security took place in Lille and covered a large spectrum of topics, from hardware attacks to lets encrypt emergency fallbacks while showing some reverse engineering explorations. Fabrice presented the future advances in CryptPad and the talk was well received by the attendees, tackling the way CryptPad is built around cryptography as a means to ensure the data and identity privacy of its users. It then continued on showing the results of the NLnet NGI0 Blueprints project that finished in May 2024. A recording of the talk is available, and more can be found on our PeerTube channel.

Additionally, CryptPad made an impact at several European open-source events, where our sponsoring company, XWiki SAS, hosted a booth. These gatherings provided the perfect platform to showcase CryptPad’s capabilities, engage directly with the open-source community, and connect with like-minded individuals passionate about privacy, cryptography, and real-time collaboration. It was a great opportunity to answer questions, demonstrate our commitment to secure and open technology, and build meaningful relationships.

📰 Press

We're proud to see that CryptPad has been used once again by the French newspaper Le Monde. This time, CryptPad served to share the list of references behind a video analyzing the disproportionate contribution of rich people to climate change.

Partnerships

We formalized a new collaboration between CryptPad and the Canòdrom, a unique space in Barcelona dedicated to exploring the intersection of technology and democracy. This collaboration underscores our shared commitment to building a digital future that is transparent, inclusive, and respects users' autonomy and privacy. Through this collaboration, we are thrilled to join a dynamic ecosystem of forward-thinking projects like Decidim, Coopdevs, DataForGoodBCN, femProcomuns, FemDevs, and Tecnopolítica, among others.

Our team

The team continued to grow in 2024, welcoming Andreea as a part-time member following her productive internship. She continued to focus on improving the OnlyOffice integration in collaboration with Wolfgang.

What to look forward to in 2025

Exciting things are in store for this year:

💐 Spring release (2025.3.0) planned for the end of March 2025;
🚀 OnlyOffice upgrade to version 8;
🛠 Administration panel improvements;
👐 Welcoming a new intern in the spring to work on cryptography improvements.

CryptPad wouldn't be what it is today without the numerous fundings, subscribers on CryptPad.fr, contributors, and everyone who has donated to our OpenCollective campaign. If you'd like to go a step further and support CryptPad and help its development and effort to take data privacy back, you can always make a donation on Open Collective or subscribe on cryptpad.fr.

Keep in touch with us through our social media channels as well:

Overview of CryptPad in 2024

Projects & funding