Deployment guide

CryptPad

Overview

CryptPad is a fully open-source, end-to-end encrypted collaboration suite that you host yourself, a privacy-first alternative to the mainstream online office suites. Every document is encrypted and decrypted in your browser, so the server stores only ciphertext and never sees your content or your password.

Your team gets real-time collaborative rich text Pads, Code and Markdown editors, and full OnlyOffice-backed Documents, Spreadsheets and Presentations. You also get Kanban boards, a Whiteboard, Forms and Polls, a Calendar, and an encrypted Drive to organize it all.

The SecureAnyCloud image installs CryptPad 2026.5.1 (AGPL-3.0-or-later licensed) to /opt/cryptpad. It runs on Node.js 22 LTS as a hardened systemd service bound to the loopback address, fronted by nginx.

CryptPad's security sandbox needs two separate browser origins. The image serves a main origin on port 80 and an isolated sandbox origin on port 3001, and configures both automatically on first boot from the instance's own public IP.

CryptPad is end-to-end encrypted, so there is no server-side administrator password. The admin panel ships locked, and you unlock it by adding your own account's public signing key. Every VM generates its own unique secrets and an empty datastore on first boot.

What you get:

CryptPad 2026.5.1 in /opt/cryptpad, running on Node.js 22 LTS
The OnlyOffice document editors for Documents, Spreadsheets and Presentations
The CryptPad server bound to loopback (127.0.0.1:3000 plus the websocket on 3003), never exposed directly
nginx serving the main origin on :80 and the isolated sandbox origin on :3001
Two per-VM origins written on first boot from the instance's public IP, never a baked-in hostname
An empty adminKeys list: no administrator ships in the image, and you promote yourself
A fresh, unique instance install token and datastore generated on first boot
cryptpad.service and nginx.service as systemd units
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size for a small team.

In the network security group (NSG), allow inbound 22/tcp from your management network. Also allow 80/tcp (the main origin) and 3001/tcp (the security sandbox origin), each from your users' own address range (<your-client-cidr>), never 0.0.0.0/0. Both 80 and 3001 must be reachable by your users' browsers, or the sandbox cannot load.

CryptPad serves plain HTTP by default. For production, put your own domain in front and terminate TLS (see Step 13).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for CryptPad by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), HTTP (80) and custom TCP 3001.

Select Review + create, then Create. Then, on the VM's Networking page, set each rule's Source to your own IP addresses or CIDR range rather than Any.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:cryptpad:default:latest
az vm create \
  --resource-group <your-rg> \
  --name cryptpad \
  --image sac1647283583153:cryptpad:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az network nsg rule create --resource-group <your-rg> --nsg-name cryptpadNSG \
  --name cryptpad-80-users --priority 1010 --direction Inbound --access Allow --protocol Tcp \
  --source-address-prefixes <your-client-cidr> --destination-port-ranges 80
az network nsg rule create --resource-group <your-rg> --nsg-name cryptpadNSG \
  --name cryptpad-3001-users --priority 1020 --direction Inbound --access Allow --protocol Tcp \
  --source-address-prefixes <your-client-cidr> --destination-port-ranges 3001

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services and the two-origin architecture

CryptPad runs as cryptpad.service (the Node.js server, bound to loopback), with nginx.service as the public reverse proxy.

The check below shows both services active and the listeners. CryptPad on 127.0.0.1:3000 (HTTP) and 127.0.0.1:3003 (websocket) is bound to loopback only. nginx listens publicly on :80 (the main origin) and :3001 (the sandbox origin).

systemctl is-active cryptpad.service nginx.service
sudo ss -tlnp | grep -E ':3000|:3003|:80 |:3001' node --version

Both services report active. The CryptPad ports are bound to 127.0.0.1 only, nginx is the sole public listener on :80 and :3001, and Node.js reports v22.x.

Step 5 - Retrieve your per-VM instance details

Each VM generates its own instance details on first boot and writes them to a root-only file. The file includes a one-time link that you can use to create the first administrator account.

Read the file, and confirm that nginx also serves the site on port 80:

sudo cat /root/cryptpad-credentials.txt curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://localhost/

The file contains CRYPTPAD_URL (your main origin), CRYPTPAD_SANDBOX_URL, and a CRYPTPAD_INSTALL_TOKEN with a one-time CRYPTPAD_ADMIN_SETUP_URL for creating your first admin. The landing page returns HTTP 200 through nginx.

Store these details somewhere safe.

Step 6 - The two-origin security sandbox

CryptPad isolates untrusted UI in a separate browser origin (the sandbox) from the origin that holds your account keys. An XSS in the interface therefore cannot reach your cryptographic keys.

This image sets both origins to your VM's own address on first boot. The live server configuration below shows the per-VM main and sandbox origins and an empty admin key list:

curl -s http://localhost/api/config | grep -E 'httpUnsafeOrigin|httpSafeOrigin|adminKeys'

httpUnsafeOrigin is your main origin (http://<vm-public-ip>), httpSafeOrigin is the sandbox origin on port 3001 (http://<vm-public-ip>:3001), and adminKeys is an empty list. This confirms that the origins are configured per VM and that no administrator is baked into the image.

Step 7 - No baked administrator

Because CryptPad is end-to-end encrypted, there is no server-side admin password to leak. The image ships with an empty adminKeys list. Every VM regenerates its own unique install token and instance secret on first boot rather than shipping a shared one.

The check below shows the empty admin list. It also confirms a fresh per-VM install token with no pre-added administrator key:

grep -n 'adminKeys' /etc/cryptpad/config.js python3 -c "import json;L=[json.loads(x) for x in open('/var/lib/cryptpad/data/decrees/decree.ndjson') if x.strip()];print('install token present :', any(d[0]=='ADD_INSTALL_TOKEN' for d in L if isinstance(d,list) and d));print('baked admin key :', any(d[0] in ('ADD_ADMIN_KEY','ADD_ADMIN_KEYS') for d in L if isinstance(d,list) and d))"

adminKeys is [], the install token is present (freshly generated for this VM), and no administrator key is baked in. You become the administrator in Step 11.

Step 8 - Open the web UI and register

Browse to http://<vm-public-ip>/. The CryptPad landing page presents the full encrypted suite: Documents, Spreadsheets and Presentations, rich text Pads, Kanban, Code, Forms, Diagrams and more. Sign up and Log in are in the top right.

Select Sign up and choose a username and password. Confirm the warning that a lost password cannot be recovered, because your data is end-to-end encrypted.

Step 9 - Collaborate on a pad

Create a Rich text pad from the landing page. CryptPad opens the collaborative editor with a full formatting toolbar. Everything you type is encrypted in your browser before it reaches the server.

Use Share to invite colleagues by encrypted link, and edit the same document together in real time. The count in the top right shows how many people are online.

Step 10 - Your encrypted Drive

Once you are signed in, your CryptDrive organizes every document, spreadsheet, presentation and pad that you create or that is shared with you. Create nested folders, use Templates and Trash, and track your storage.

Everything in the Drive is end-to-end encrypted.

Step 11 - Promote yourself to administrator

No administrator ships in the image. To unlock the admin panel, open Settings and copy your account's Public Signing Key (the bracketed [cryptpad-user...] string).

Add the key to the adminKeys list in the configuration file and restart CryptPad:

sudo nano /etc/cryptpad/config.js
# set: adminKeys: [ "[your-public-signing-key]" ],
sudo systemctl restart cryptpad

Alternatively, visit the one-time CRYPTPAD_ADMIN_SETUP_URL from Step 5 to create the first administrator directly. After either method, the Admin panel at /admin becomes available to your account.

Step 12 - Registration and instance policy

Open registration is enabled by default so that your team can create accounts. The server can never read encrypted data, so this is a reasonable default for a private instance.

Once you are an administrator, you can close registration from the admin panel (Users, then Close registration) so that only existing users remain. Storage limits, the instance name and other policies are also managed from the admin panel.

Step 13 - Add a custom domain and HTTPS for production

CryptPad works over plain HTTP on a bare IP, but for production use your own domain with TLS.

Point two names at the VM: a main domain and a sandbox domain, for example pad.example.com and sandbox-pad.example.com. Obtain certificates for both:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d pad.example.com -d sandbox-pad.example.com

Edit /etc/cryptpad/config.js and set httpUnsafeOrigin: 'https://pad.example.com' and httpSafeOrigin: 'https://sandbox-pad.example.com'. Then run sudo systemctl restart cryptpad so that generated links and the security sandbox use your HTTPS domains.

Serving over HTTPS also enables the offline service worker and other secure-context features.

Maintenance

Restart the app: sudo systemctl restart cryptpad.service
View logs: sudo journalctl -u cryptpad.service -e
Configuration: runtime settings live in /etc/cryptpad/config.js. The app is in /opt/cryptpad and the data is in /var/lib/cryptpad.
OS updates: unattended-upgrades is enabled. Apply the latest security updates with sudo apt-get update && sudo apt-get -y upgrade, and reboot if a new kernel is installed.
Back up: stop cryptpad.service, then copy /var/lib/cryptpad (the encrypted datastore, blocks, blobs and decrees).

Support

SecureAnyCloud maintains this image and provides 24/7 support. CryptPad is licensed under AGPL-3.0-or-later and is shipped unmodified.

"CryptPad" is a trademark of its respective owner. SecureAnyCloud provides this image, which is not endorsed by or affiliated with CryptPad or XWiki.

Deploy on Azure

Launch CryptPad on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure