CryptPad 2026.10.0 on AWS User Guide

Overview

This guide covers launching and using the CryptPad 2026.10.0 on Ubuntu 24.04 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg Nextcloud, office suites and workspaces listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

CryptPad is an open source, end to end encrypted collaboration suite. Rich text pads, documents, spreadsheets and presentations (OnlyOffice based editors), code and markdown pads, kanban boards, a whiteboard, forms, a calendar and a drive are all encrypted and decrypted in the browser: the server stores ciphertext only and never sees your documents or your password.

What the cloudimg image adds:

• HTTPS on both origins from the first boot. CryptPad keeps untrusted document content on a second, separate origin (a "sandbox") so it cannot reach your keys. On this image nginx serves the main site on port 443 and the sandbox on port 8443, both with a certificate generated on your instance at first boot. Port 80 redirects to HTTPS, a request for a host name the instance does not serve gets no answer, and CryptPad's own Node.js processes listen on 127.0.0.1 only.
• Registration closed, no baked administrator. Upstream CryptPad lets anyone who reaches it create an account. Here first boot closes public registration and creates ONE single use first account link that only you can read (Step 4). You register with it, then one command makes that account the administrator (Step 6). Nobody else can sign up until you invite them or reopen registration yourself.
• Per instance secrets. The TLS key, the first account link and CryptPad's internal secrets are created on your instance at first boot. None is baked into the image, and none is written to a log.
• Metadata access blocked, and an outbound firewall for CryptPad. nginx, CryptPad and the first boot service are blocked from the instance metadata service, and the AMI requires IMDSv2. CryptPad's own processes may not connect to the metadata service, to private or reserved ranges, to your VPC's own addresses or to IPv6 (Step 9).
• Open fonts in the office editors. cloudimg removes the proprietary Microsoft and Monotype fonts (Arial and Calibri) that the upstream office bundle includes, and substitutes the metric compatible open fonts Arimo and Carlito, so documents keep their layout.
• Read only code and configuration. CryptPad, Node.js and the helper scripts are owned by root; the cryptpad user that runs the server can write only its data directory, /var/lib/cryptpad.
• Fully patched Ubuntu 24.04 LTS at build time, with unattended security upgrades switched on.

What is on the image: CryptPad 2026.10.0 (the upstream release tarball, sha256 verified), the OnlyOffice editors and x2t converter CryptPad uses (v9.3.2+3), Node.js v24.22.2 in /opt/node, nginx, Ubuntu 24.04 LTS, cloud-init and the AWS Systems Manager agent.

Default user: ubuntu · Architecture: x86_64 · Recommended instance type: m5.large

Prerequisites

• An AWS account subscribed to the listing, an EC2 key pair and a VPC subnet with a route to the internet (or a private route you use for management).
• A security group that allows TCP 22 (SSH) from your admin network, and TCP 443 (CryptPad), TCP 8443 (CryptPad's sandbox origin, required) and TCP 80 (redirects to HTTPS) from the networks your users work from.

Step 1: Launch the instance

In the AWS Marketplace listing choose Continue to Subscribe, then Continue to Configuration, pick CryptPad 2026.10.0 on Ubuntu 24.04 as the software version and your Region, then Launch through EC2. Choose m5.large (a t3.large is enough for a small team), your key pair and a security group as above.

With the AWS CLI (replace the values in angle brackets):

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=cryptpad}]'

First boot creates the certificate, the first account link and CryptPad's data, and finishes about a minute after the instance is running.

Step 2: Connect to your instance

ssh -i <your-key.pem> ubuntu@<public-ip>

Step 3: Check the services

nginx and CryptPad start only after first boot has finished:

systemctl is-active nginx cryptpad cryptpad-egress-guard cryptpad-firstboot
sudo test -f /var/lib/cloudimg/cryptpad-firstboot.done && echo FIRSTBOOT_DONE

All four units are active and the first boot marker is present (after a later reboot cryptpad-firstboot shows inactive, because it runs only once):

active
active
active
active
FIRSTBOOT_DONE

Only SSH and nginx listen on network ports. CryptPad's server processes (shown by ss as MainThread) listen on 127.0.0.1 only:

sudo ss -lntp | awk 'NR>1 && $4 !~ /^127\.0\.0\.5[34]/ {split($6, p, "\""); print $4, p[2]}' | sort

0.0.0.0:22 sshd
0.0.0.0:443 nginx
0.0.0.0:80 nginx
0.0.0.0:8443 nginx
127.0.0.1:3000 MainThread
127.0.0.1:3010 MainThread
127.0.0.1:3011 MainThread
127.0.0.1:3020 MainThread
127.0.0.1:3021 MainThread
127.0.0.1:3030 MainThread
127.0.0.1:3031 MainThread
127.0.0.1:3040 MainThread
127.0.0.1:3041 MainThread
[::]:22 sshd
[::]:443 nginx
[::]:80 nginx
[::]:8443 nginx

Step 4: Get your URLs and your first account link

sudo cat /root/cryptpad-credentials.txt

The file is readable by root only:

# CryptPad 2026.10.0 - generated on first boot by cryptpad-firstboot.service
# These values are unique to this instance; none was baked into the image. Keep this file secret.

CRYPTPAD_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/
CRYPTPAD_SANDBOX_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com:8443/
CRYPTPAD_FIRST_ACCOUNT_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/register/#<FIRST_ACCOUNT_TOKEN>
CRYPTPAD_FIRST_ACCOUNT_TOKEN=<FIRST_ACCOUNT_TOKEN>
#
# Registration is CLOSED: members of the public cannot create accounts on this instance.
# 0. The certificate is self-signed (minted on this instance's first boot): open CRYPTPAD_URL and then
#    CRYPTPAD_SANDBOX_URL once each in your browser and accept the certificate (or set your own name and
#    certificate, see the guide). The sandbox origin (port 8443) keeps untrusted content away from your keys.
# 1. Open CRYPTPAD_FIRST_ACCOUNT_URL and register your account (the link works once).
# 2. Make that account the administrator:   sudo cryptpad-add-admin
#    then reload CryptPad: Administration appears in the user menu.
# 3. Invite colleagues from Administration > Users (invitation links), or reopen public registration there.
# CryptPad is end-to-end encrypted: the server never sees your documents or your password.
# Change the name it serves as:   sudo cryptpad-set-hostname <your-dns-name>
# Check the instance:             sudo cryptpad-selftest
# User guide: https://www.cloudimg.co.uk/guides/cryptpad-2026-10-0-on-ubuntu-24-04-aws/

The URLs use the instance's public DNS name from the EC2 instance metadata, and the certificate also names the private IP address. nginx answers only to those names. The name is fixed at first boot, so if you stop and start the instance without an Elastic IP and its public address changes, run sudo cryptpad-set-hostname with the new name (Step 8), or better, give the instance an Elastic IP or your own DNS name.

Step 5: Accept the certificate on both origins

The certificate was generated on your instance, so your browser warns about it the first time. Open CRYPTPAD_URL and accept the certificate, then open CRYPTPAD_SANDBOX_URL (the same name on port 8443) and accept it there too. CryptPad loads its editors from the sandbox origin, so if you skip the second step the documents, sheets and presentations stay blank. With your own DNS name and a certificate from a public authority (Step 8) there is no warning at all.

Step 6: Create your account and make it the administrator

Open CRYPTPAD_FIRST_ACCOUNT_URL from Step 4 in your browser. It opens CryptPad's registration page with a one time invitation: choose a user name and a strong password and register. CryptPad derives your encryption keys from that password in your browser; the server never receives it and cannot reset it, so store it in a password manager. The link works once: after your account exists it is refused, and so is every sign up without an invitation.

After you register, CryptPad opens your encrypted Drive:

Then make that account the administrator:

sudo cryptpad-add-admin

It finds the account created with your first account link, adds its public signing key to adminKeys in /etc/cryptpad/config.js and restarts CryptPad:

ADMIN_ADDED <your-public-signing-key>
Reload CryptPad in your browser: Administration is now in the user menu.

A second run changes nothing and prints ADMIN_ALREADY <your-public-signing-key>. To make another account an administrator later, copy its Public Signing Key from that user's Settings page and pass it in quotes: sudo cryptpad-add-admin '<public signing key>'.

Step 7: Documents, sheets and presentations

From the CryptPad home page or your Drive, choose Document, Sheet or Presentation to create an encrypted office file, or Rich text, Code, Kanban, Whiteboard or Form for the other apps. Share a document with the Share button: the link carries the key, so only the people you give it to can read it.

The office editors use open fonts in place of Arial and Calibri: a document that asks for Arial is drawn with Arimo, and Calibri with Carlito. Both have the same character widths, so documents imported from other office suites keep their line and page breaks. You can confirm that the open fonts are present and the proprietary ones are not:

F=/opt/cryptpad/www/common/onlyoffice/dist/v9/fonts/fonts
echo "Arimo/Carlito files: $(find "$F" -iname 'arimo*' -o -iname 'carlito*' | wc -l)"
echo "Arial/Calibri files: $(find / -xdev \( -iname 'arial*.ttf*' -o -iname 'calibri*.ttf*' \) 2>/dev/null | wc -l)"

Arimo/Carlito files: 8
Arial/Calibri files: 0

A new document, sheet and presentation, each with the default Calibri font, drawn with Carlito:

To let more people in, open Administration from the user menu: Users creates invitation links, and the General tab can reopen public registration if you want an open instance.

Step 8: Your own DNS name and certificate

Point a DNS name (an A record, ideally to an Elastic IP) at the instance, then run:

sudo cryptpad-set-hostname <your-domain>

It writes the name into CryptPad's configuration and nginx (main site on 443, sandbox on 8443 of the same name), mints a new self signed certificate for it, restarts the services and prints the new certificate's SHA-256 fingerprint. CryptPad's sandbox origin must stay distinct from the main origin, so keep port 8443 open in your security group. If you put a load balancer or a reverse proxy with a public certificate in front of the instance, forward both 443 and 8443 and keep the host name the same as the one you set here.

Step 9: What CryptPad can connect to

CryptPad needs no outbound connection to work. Its processes run as the cryptpad user, and an nftables firewall (loaded at every boot by cryptpad-egress-guard) refuses that user every connection to the metadata service, loopback services other than CryptPad's own, private and reserved ranges, your VPC's address ranges and IPv6. You can see it from the instance:

sudo -u cryptpad curl -sS -m 5 -o /dev/null http://169.254.169.254/latest/meta-data/ || echo "refused for the cryptpad user"

curl: (7) Failed to connect to 169.254.169.254 port 80 after 0 ms: Couldn't connect to server
refused for the cryptpad user

If you add an integration inside your VPC (for example a single sign on provider), list its address, one private CIDR per line, in /etc/cloudimg/cryptpad-egress-allow and run sudo systemctl reload cryptpad-egress-guard. Metadata, link local, loopback and multicast ranges are always refused.

Step 10: Security checks

One command checks the instance end to end from the instance itself: both origins over HTTPS, registration closed (an anonymous sign up is refused with E_RESTRICTED), a cross origin WebSocket refused, and a real encrypted pad written and read back over CryptPad's WebSocket:

sudo cryptpad-selftest

main https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/ 200; sandbox https://ec2-<public-ip-dashed>.compute-1.amazonaws.com:8443/ 200; registration closed; REGPROBE REFUSED E_RESTRICTED; cross-origin WebSocket 403; PADPROBE OK <pad-id>
CRYPTPAD_SELFTEST_OK

CryptPad's own health page is at https://<your-host>/checkup/. Once both origins' certificates are accepted it passes 53 of its 55 tests. The two it reports are settings that only you can choose: an administrator contact email (Administration > General > Admin contact email) and encrypted support tickets (Administration > Support). Set both and press Flush HTTP cache, and the checkup passes every test.

Step 11: Backup, storage and maintenance

Everything CryptPad stores (encrypted documents, the drive, uploaded files, accounts and its decree log) is under /var/lib/cryptpad; its configuration is /etc/cryptpad/config.js and /etc/cryptpad/infra.js. Because documents are end to end encrypted, a backup contains only ciphertext. Stop CryptPad for a consistent copy:

sudo systemctl stop cryptpad
sudo tar -C /var/lib -czf <backup-dir>/cryptpad-$(date +%F).tar.gz cryptpad
sudo systemctl start cryptpad

Keep backups and EBS snapshots private: they hold your users' encrypted data and their account blocks. Ubuntu security updates install automatically; CryptPad itself is updated by moving to a newer version of this listing and restoring your data directory.

Step 12: Security recommendations

• Keep TCP 22 open only to your admin network, and 80, 443 and 8443 only to the networks your users work from.
• Use your own DNS name and a publicly trusted certificate for production (Step 8).
• Keep registration closed and invite users from Administration > Users unless you mean to run a public instance.
• Remind users that CryptPad cannot recover a forgotten password: encourage a password manager.

Support and licensing

CryptPad is open source under the GNU Affero General Public License, version 3 or (at your option) any later version, and the OnlyOffice editors and x2t converter CryptPad bundles are under the GNU AGPL v3. There is no per user licence fee. The image ships CryptPad as released apart from one packaging change: cloudimg removes the proprietary Microsoft and Monotype fonts (Arial and Calibri) that the upstream office bundle includes, and substitutes the metric compatible open fonts Arimo and Carlito. /usr/share/doc/cloudimg-cryptpad/SOURCE.txt names the releases, their download addresses and checksums, next to the licence texts. The AMI price covers cloudimg's hardening, first boot setup and support.

• Email: support@cloudimg.co.uk
• Website: https://www.cloudimg.co.uk
• Support: 24/7, with a 24 hour response SLA

The CryptPad documentation covers using and administering CryptPad.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them. CryptPad is a project of XWiki SAS and its contributors; cloudimg is not affiliated with it.