CryptPad vs EtherCalc: Privacy Collaboration

Your Spreadsheet Knows Too Much

Google Sheets sees everything you type. Microsoft 365 knows your pivot tables before your boss does. And Notion — honestly, at this point just forward your notes directly to their marketing team and cut out the middleman.

So you decide to self-host your collaboration tools. Smart move. But then you hit the wall: there are a lot of options, and most of them are either bloated enterprise suites or weekend projects last updated in 2019.

Two tools that actually hold up for real-world self-hosting are CryptPad and EtherCalc. They’re both open source, both Docker-friendly, and both will keep your data off someone else’s servers. But they’re solving very different problems, and picking the wrong one will leave you either drowning in features you don’t need or screaming at a spreadsheet that can’t handle basic auth.

Let’s break it down.

What You’re Actually Comparing

CryptPad (from XWiki Labs) is a full collaboration suite — rich text documents, spreadsheets, kanban boards, presentations, code editors, polls, forms. The killer feature: end-to-end encryption. The server stores ciphertext. Even if someone pops your VPS, they get encrypted blobs. It’s AGPL-licensed and actively maintained as of 2026.

EtherCalc (originally by Audrey Tang, now community-maintained) is a single-purpose realtime spreadsheet. That’s it. No encryption, no user accounts, no fancy features. It’s Node.js + Redis, and it’s fast precisely because it doesn’t try to be anything it’s not.

Here’s the honest summary before we go deeper:

CryptPad: The Full Privacy Stack

How the Encryption Actually Works

CryptPad uses a CRDT (Conflict-free Replicated Data Type) approach for real-time sync, combined with client-side encryption. When you create a document, your browser generates a symmetric key. All edits are encrypted locally before they leave your device. The server receives and stores ciphertext — it can’t read your content even if it wanted to.

Sharing works by passing the decryption key in the URL fragment (the # part), which browsers don’t send to the server. So /pad/view/abc123#decryptionkey — the server sees abc123, your browser handles decryptionkey. It’s clever, and it actually holds up under scrutiny.

This trades some performance. Large documents on a shared server will feel sluggish compared to plaintext alternatives. The CRDT merge is heavier than EtherCalc’s operational transform. For a family spreadsheet or a team document, you won’t notice. For a 10,000-row dataset with 20 concurrent editors, you might.

Setting Up CryptPad with Docker

CryptPad’s Docker setup is straightforward but has one quirk: you need two subdomains. The main app runs on your primary domain, but CryptPad serves document content from a separate “sandbox” domain to prevent XSS. This is intentional and you can’t skip it.

services:
  cryptpad:
    image: cryptpad/cryptpad:2024.12.0
    container_name: cryptpad
    restart: unless-stopped
    environment:
      - CPAD_MAIN_DOMAIN=https://pad.example.com
      - CPAD_SANDBOX_DOMAIN=https://sandbox.example.com
      - CPAD_HTTP_UNSAFE_ORIGIN=https://pad.example.com
      - CPAD_HTTP_SAFE_ORIGIN=https://sandbox.example.com
      - [email protected]
    volumes:
      - cryptpad_data:/cryptpad/data
      - cryptpad_config:/cryptpad/config
    ports:
      - "3000:3000"

volumes:
  cryptpad_data:
  cryptpad_config:

Pull the image, spin it up once, then grab the generated config.js from the config volume and tweak it:

docker compose up -d
docker compose exec cryptpad cat /cryptpad/config/config.js > config.js

The config file has sensible defaults, but you’ll want to set a few things explicitly:

// config.js — key settings to review
module.exports = {
    httpUnsafeOrigin: 'https://pad.example.com',
    httpSafeOrigin: 'https://sandbox.example.com',
    adminEmail: '[email protected]',

    // Storage limits per user (bytes)
    defaultStorageLimit: 50 * 1024 * 1024,  // 50 MB

    // Block additional registrations after you've set up your team
    restrictRegistration: false,

    // Archive old data instead of deleting immediately
    archiveRetentionTime: 15,  // days
};

Mount the modified config back in before restarting:

    volumes:
      - ./config.js:/cryptpad/config/config.js
      - cryptpad_data:/cryptpad/data

Caddy Reverse Proxy for CryptPad

Both subdomains need to proxy to the same container. Caddy handles TLS for both:

pad.example.com {
    reverse_proxy cryptpad:3000
    encode gzip
}

sandbox.example.com {
    reverse_proxy cryptpad:3000
    encode gzip
}

That’s genuinely it for Caddy. The two-domain setup feels weird but it’s a security feature — document content loads from the sandbox domain with no access to the main domain’s cookies or localStorage.

First Run and Admin Setup

Navigate to https://pad.example.com and register the first account. CryptPad flags the first registered user as admin automatically, or you can add your public key to the config’s adminKeys array after the fact.

From the admin panel you can monitor storage, set quotas, and review who’s registered. There’s no LDAP or SSO out of the box — accounts are CryptPad-native. If you need SSO, you’re looking at CryptPad Enterprise or a custom setup.

EtherCalc: Just the Spreadsheet

When Simple Is Right

EtherCalc is for when you want a shared spreadsheet and literally nothing else. No accounts, no encryption overhead, no two-subdomain dance. You get a URL, multiple people edit simultaneously, changes sync. Done.

It uses operational transforms (not CRDT) for conflict resolution, which is simpler and faster for a single-app use case. The tradeoff: your data lives in Redis, in plaintext. Anyone with Redis access can read your spreadsheets. Keep that in mind when you’re placing it in your network.

EtherCalc with Docker Compose

services:
  ethercalc:
    image: audreyt/ethercalc:latest
    container_name: ethercalc
    restart: unless-stopped
    environment:
      - REDIS_URL=redis://redis:6379
    ports:
      - "8000:8000"
    depends_on:
      - redis

  redis:
    image: redis:7-alpine
    container_name: ethercalc_redis
    restart: unless-stopped
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data

volumes:
  redis_data:

That’s the whole thing. Start it up:

docker compose up -d

Visit http://localhost:8000 and you get a blank spreadsheet. The URL is the document ID — share it, and anyone with the link can edit. No sign-in, no setup, no friction.

Caddy for EtherCalc

calc.example.com {
    reverse_proxy ethercalc:8000
    encode gzip
}

One domain. One subdomain. TLS handled. You’re done in 60 seconds.

What EtherCalc Doesn’t Have

No version history. No user accounts. No mobile-optimized UI (it works, it’s not great). If you need any of those things, you’re in the wrong tool. EtherCalc’s strength is its scope — it does one thing and doesn’t try to bolt on features that would compromise its simplicity.

Real-World Use Cases

Family Meal Planning (CryptPad Sheets)

You’re sharing a weekly meal plan with your partner. You’ve got dietary restrictions, a budget, and neither of you wants Google knowing your Thursday pasta schedule.

CryptPad Sheets is the right call here. Create a spreadsheet in your shared drive, drop in the link, and you’re collaborating. The E2EE means your meal plan stays private (yes, this sounds paranoid; no, it’s not). Both of you can have registered accounts with shared team drives, which means the doc shows up in both your drives rather than requiring you to pass a link around.

The CRDT sync handles simultaneous edits cleanly — if you’re both editing different cells at the same time, it merges without a fight.

Team Running Expense Tally (EtherCalc)

Your running club tracks race fees and shared equipment costs. Five people, one spreadsheet, no signup required.

EtherCalc is perfect for this. You don’t care about encryption — these aren’t secrets, they’re expense splits. You want zero friction: drop a URL in the group chat, everyone opens it, everyone edits. EtherCalc’s performance is noticeably snappier than CryptPad for concurrent editing because it’s not doing crypto operations on every keystroke.

Drafting a Privacy Policy with Multiple Contributors (CryptPad Docs)

Your small business is writing a privacy policy. Multiple contributors, tracked changes would be nice, and you’d rather not have the draft sitting on a random SaaS platform.

CryptPad Documents (the rich text editor) handles this well. Version history is built in — you can roll back to any previous state. Anonymous editing is supported for external reviewers who don’t have accounts. And since it’s E2EE, your draft privacy policy stays private while it’s being written. That’s a nice bit of irony avoidance.

The Honest Performance Trade-Off

CryptPad’s encryption is genuinely impressive engineering. It’s also not free. Every edit encrypts before it leaves the browser, every load decrypts after it arrives. On modern hardware with a small team this is imperceptible. At scale — large documents, many concurrent users, low-powered VPS — you’ll feel it.

EtherCalc runs on a $5/month VPS and barely registers in htop. CryptPad wants at least 1 GB RAM comfortably, and that’s without a heavy document load.

If your threat model is “I don’t want my documents on Google’s servers” and the data itself isn’t particularly sensitive, EtherCalc is arguably over-engineered for privacy and under-engineered for features. If your threat model is “the server admin cannot read this data,” CryptPad is the only option between these two.

The Bottom Line

Pick CryptPad if:

• You need genuine end-to-end encryption and the server should never see plaintext
• You want more than just spreadsheets — docs, kanban, slides, forms
• You’re setting up a small team with registered accounts and shared drives
• Version history and document recovery matter to you

Pick EtherCalc if:

• You need a fast, frictionless shared spreadsheet and nothing else
• The data isn’t sensitive — expense splits, shared schedules, public-facing trackers
• You want minimal resource usage and maximum simplicity
• You don’t need accounts, history, or mobile polish

Honestly, these tools aren’t really competing. CryptPad is a collaboration suite that happens to include a spreadsheet. EtherCalc is a spreadsheet that happens to be self-hosted. If you’re running both on the same server, they serve different needs and don’t step on each other.

Start with EtherCalc if you just need a shared sheet. Reach for CryptPad when someone on your team says the word “encryption” and actually means it. Your 2 AM self, trying to remember whether the shared doc with the API keys is on Google Drive or somewhere sensible, will appreciate the distinction.

Related Reading

• AdGuard DNS Sync Across Two Instances
• Anubis: Anti-AI-Crawler Proof-of-Work
• BTCPay Server: Self-Hosted Crypto Payments
• Blog Comments: Self-Host or SaaS?
• De-Googling: Self-Hosted Replacements for Google Apps