SumizAI vs CryptPad

What CryptPad is

What CryptPad is

CryptPad is a French, open-source office suite built on a zero-knowledge architecture — all content is encrypted in the browser before it ever reaches the server, so the service provider has no technical way to read a user's documents. The suite covers a text editor, spreadsheets, kanban boards, whiteboards, forms, and Markdown pads — a functional counterpart to Google Workspace, but with encryption as the foundation rather than an add-on.

Key features

Despite strong encryption, CryptPad offers full real-time collaboration — multiple users can edit the same document at once, with changes appearing live, just like in unencrypted cloud tools. The app supports comments on documents and a built-in chat for quick communication while working together. Access control lets you share documents as view-only or with full editing rights, depending on the need. The encryption has been independently audited, setting CryptPad apart from many tools that market themselves as "private" without verifiable proof.

Who it's for

CryptPad appeals to teams and organizations for whom document confidentiality is a requirement, not just a preference — law firms, NGOs operating in countries with surveillance concerns, companies subject to EU data-protection regulation. Anyone wanting a Google Workspace alternative without handing document content to the service provider will find a functional replacement with a comparable toolset here.

Use cases

In practice, CryptPad works well for collaborating on sensitive legal or financial documents, running kanban boards for project management without exposing their content to a cloud provider, or collecting form responses containing personal data in a GDPR-compliant way. An organization with its own infrastructure can self-host CryptPad, keeping full control over where the encrypted data physically resides.

Pricing and business model

CryptPad offers a free plan with 1GB of storage, and paid plans start at 5 euros a month for 5GB, scaling up for larger needs. Enterprise plans range from roughly €3,000/year for 50 users and 100GB up to €25,000/year for 1,000 users and 1TB. Organizations can also self-host CryptPad for free, using the AGPL-3.0-licensed open-source code and paying only for their own server infrastructure.

Limitations and what to watch for

The zero-knowledge architecture means that if a user forgets their password, CryptPad — by design — has no technical way to help recover access to the encrypted content, since the server never saw the decryption key. The free 1GB limit can feel tight for teams working with a large number of documents or attachments, quickly forcing a move to a paid plan.

AI notes the provider can never read

CryptPad has no built-in AI integration, but the Markdown pad in the suite is well suited for pasting an ai notes entry from a conversation with an AI assistant — content is encrypted client-side, so even an ai notes entry containing sensitive information from an AI conversation never reaches the server in a form the provider could read. For teams combining work with AI models and a confidentiality requirement, that's a practical combination — the ai notes entry lands in an encrypted pad instead of a plain, unencrypted text file.

Zero-knowledge as a foundation, not a marketing add-on

Many tools market themselves as "private" while technically still being able to read user content on the server. CryptPad differs in that its zero-knowledge architecture physically prevents the provider from accessing unencrypted data — this isn't a policy a company could change by board decision, it's a property of the cryptographic system itself.

French origin and GDPR alignment

As a project developed in France, within the EU, CryptPad naturally fits GDPR requirements, which can be a meaningful argument for European organizations looking for an alternative to American cloud giants operating under a different data-protection legal regime.

The Markdown pad as a mode of its own

Among CryptPad's six document types, the Markdown pad stands out for not trying to mimic a WYSIWYG editor like the rest of the suite — it's a plain text editor with a formatted preview alongside it, making it a natural place for quick, raw ai notes pasted from a conversation with an assistant, with no risk that an editor's auto-formatting will mangle the text's structure on paste. A team keeping a shared archive of conclusions from AI conversations can hold all such ai notes in one shared Markdown pad, using the same access controls as the suite's other documents.

What's worth checking before choosing

Before migrating an entire team, test the free plan's 1GB limit with the team's actual documents to gauge how quickly you'd need to move to a paid plan, and check whether self-hosting on your own infrastructure might be cheaper at larger scale.

Bottom line

CryptPad is an office suite with zero-knowledge encryption as its foundation, offering real-time collaboration with no compromise on confidentiality. Anyone who wants ai notes from AI conversations to land in a pad the provider physically cannot read will find a practical place to store them here.

A security audit as verifiable proof, not a claim

Many companies claim "end-to-end" encryption in marketing material without submitting the code to independent verification. CryptPad has gone through an external security audit of its cryptographic implementation, and the results are publicly available — that's the difference between a promise and something that can actually be checked. For legal teams or compliance departments evaluating tools against real risk, the availability of such an audit can be a hard requirement before a tool is approved for sensitive data.

Comparison with SumizAI

CryptPad and SumizAI differ in their data-storage model and purpose. CryptPad encrypts documents client-side and stores them on a server (self-hosted or the provider's) in a form unreadable to anyone without the key. SumizAI stores these notes as plain Markdown files in a folder on the user's own disk — the data never reaches any SumizAI server, since the app connects directly to the chosen AI provider's API on the user's own account. Anyone needing encrypted team collaboration on documents will pick CryptPad; anyone who wants AI conversations to turn automatically into these notes stored locally as Markdown files will find SumizAI the better-fitting tool.

That is our reading of the record. For AlternativeTo's own wording, see its page for CryptPad — the facts above were read on 2026-08-16.

CryptPad in depth

An office suite designed so the server never sees your text

CryptPad is a browser-based collaborative office suite whose defining property is not its feature list but the place where decryption happens. Documents are encrypted inside the browser before anything travels to the server, and the key rides in the fragment portion of the sharing link — the part a browser never sends to the host. The operator of an instance therefore holds ciphertext and some metadata, and cannot produce a readable copy of your work for itself, for an advertiser, or for anyone who asks. The project is run by XWiki SAS, a French company otherwise known for its enterprise wiki, and the code sits in the xwiki-labs/cryptpad repository under the AGPL-3.0 licence. AlternativeTo files the product simultaneously under Office & Productivity, Remote Work & Education, Security & Privacy, Development, and Backup & Sync, which is an honest reflection of how far the suite has spread from its origins as an encrypted pad.

What the zero-knowledge model gives you and what it takes away

Encryption that the server cannot undo has consequences that are easy to skip over in a feature comparison. Because no plaintext exists on the host, there is no server-side index of everything you have ever written, no administrator who can recover an account for you, and no way for the operator to comply with a request to reveal content it genuinely cannot read. That last point is the reason the product exists. The corresponding costs are real: a lost password is a lost archive rather than a support ticket, and any capability that would normally be implemented on the server — bulk search across an organisation, retention scanning, automated classification — has to be done in the client or not at all. Sharing also works differently from a permissions model. A CryptPad link is not a pointer that the server will authorise or refuse; it carries the material needed to decrypt, so treating links as casually as one treats a shared drive URL undermines the whole design. Anonymous use is supported and genuinely functional — you can open the site and start typing without creating anything — but a document made that way is only as durable as the link you keep.

The applications actually included

The suite is far wider than the name suggests. There are rich text documents with a WYSIWYG editor, spreadsheets, a Markdown and code editor, Kanban boards, forms and polls, presentations, diagrams, a whiteboard, a calendar, a contacts list, and chat alongside the editors. A drive holds uploaded files directly, so binary attachments are not an afterthought. Spreadsheets are worth singling out because they were the most conspicuous gap in the early years: the highest-rated review on AlternativeTo, written in January 2019, praised the suite as a workable encrypted counterpart to Google Docs while explicitly asking for a spreadsheet, and that gap was later closed through the OnlyOffice-based editors. Around the editors sit the ordinary conveniences — dark mode, spell checking, offline operation, Markdown support throughout, and an extension mechanism. Localisation is unusually broad for a project this size, with roughly seventeen interface languages including French, German, Chinese, Japanese and Russian in addition to English, which matters for the European public-sector and nonprofit users the project attracts.

Where it runs: hosted, self-hosted, and packaged

Three deployment routes exist. The flagship public instance is operated by XWiki itself and is what most people mean when they say they use CryptPad. The software can also be installed on your own server, which is the option that makes the AGPL meaningful — the licence obliges anyone who runs a modified version as a network service to publish their changes, so forks cannot quietly become closed products. Finally there is a Cloudron package for people who want self-hosting without assembling the stack by hand. Self-hosting is where the most consistent criticism lands: several commenters describe the installation as confusing if you are not comfortable with server administration, and there is no desktop or mobile application to fall back on, since everything is delivered through the browser. There is no native client for Windows, macOS, Linux, Android or iOS; the platform list is SaaS, self-hosted, and Cloudron, and that is the whole of it.

Pricing, in the figures the vendor publishes

The public instance is usable for free, and the site currently advertises one gigabyte of storage at that level — an increase over the much tighter cap that older AlternativeTo commenters complained about, where fifty megabytes was described as too little to be useful. Paid subscriptions on the hosted instance are quoted as a range of five to one hundred euros per month covering individual, team and organisation plans, with the detailed tier breakdown living behind the plan selector rather than on the summary page; AlternativeTo, working from older data, records the range as five to fifteen dollars per month, so treat any specific figure as needing confirmation at the point of purchase. Managed private instances are priced separately and openly: the entry point is quoted from 1,500 euros per year, with named tiers at 3,000 euros for fifty users and 100 GB, 6,000 euros for 250 users and 200 GB, 12,500 euros for 500 users and 500 GB, and 25,000 euros for 1,000 users and one terabyte. Those bundles include a custom domain, branding and single sign-on. Nonprofits and educational institutions are offered half price, which puts the same ladder at 1,500 to 12,500 euros. Donations through OpenCollective supplement the commercial revenue.

What users report in practice

The AlternativeTo entry carries an average of 4.6 out of 5 across twenty-one ratings, roughly 191 likes and sixteen written comments, with well over a hundred alternatives listed against it. The recurring praise is that the privacy guarantee does not come at the usual usability price — reviewers repeatedly note that colleagues without any security background can be handed a link and simply start editing, and several call out the interface as pleasant rather than merely tolerable. The fact that no account is required removes the single biggest obstacle to getting an occasional collaborator to participate. The complaints are specific and worth weighing. Distinguishing who is who becomes difficult once several people edit simultaneously, because the colour cues are hard to tell apart. Polls and surveys are reported as not visible to visitors who are not signed in, which defeats part of the point of a poll. Storage on the free tier is a recurring sore point. And more than one commenter observes that the project is under-marketed relative to its capabilities, with a small team constraining how quickly it can grow — a structural limitation rather than a bug.

Project health and who it suits

The repository is written in JavaScript and, as recorded in mid-August 2026, carries about 7,845 stars, 839 forks and 385 open issues, with recent activity. That is a healthy but not enormous project, consistent with the small-team observation above: development continues steadily and the issue backlog is substantial. The combination of a commercial sponsor, subscription revenue, enterprise instances and donations gives it more financial grounding than a typical volunteer project, though the ownership of the hosted service and the code by one company is itself a consideration for organisations that want vendor independence — the AGPL and the self-hosting path are the mitigations. CryptPad is a strong fit for journalists, unions, legal and medical practices, activist groups and public bodies that need collaborative editing where the hosting party must not be able to read the material, and for anyone who wants their data on European infrastructure. It is a poor fit for heavy spreadsheet users who depend on advanced modelling features, for organisations whose compliance regime requires server-side eDiscovery, retention scanning or data-loss prevention, and for anyone who needs a native mobile app or expects an administrator to be able to recover a forgotten password. Compared with SumizAI, the purposes barely overlap: CryptPad is a place to write and store documents that no server can read, while SumizAI processes documents you deliberately hand over to it.

Product page: cryptpad.org

What SumizAI is

A note-taking application built around a conversation with an AI model. You ask a question, the answer streams back, and the answers worth keeping become Markdown notes — filed into a vault that is a folder on your own disk.

A vault is a directory holding base.md, a generated table of contents up to six levels deep, and a notes/ folder with one .md file per note. Before a note is written it is checked against the ones already there, so the fourth note about the same idea gets merged instead of added. Links between notes are ordinary Markdown links to files that exist.

The model is never ours: you bring your own API key to one of seven providers — Anthropic, OpenAI, Gemini, Groq, OpenRouter, a local Ollama or your own server — and pay that provider directly. A question sends the table of contents plus at most five relevant notes within a 24,000-character budget, and the app shows you which five it used.

Every answer kept this way becomes one of these ai notes, ready to search again months later without hunting back through old chats.

Side by side

Where they differ

• AlternativeTo's description of CryptPad does not mention an AI model. That is the whole starting point in SumizAI: you have a conversation with a model on your own API key, and the answers worth keeping become notes without you filing them.
• CryptPad is open source (AGPL-3.0), and SumizAI is not. If reading the source is what decides it for you, that is a real argument for CryptPad. The guarantee SumizAI offers instead is structural rather than legal: the notes are Markdown files in a folder you chose, so they open in any editor whether or not the application is running.
• CryptPad is freemium: there is a free tier and a paid one, and the line between them is the thing to read before committing. SumizAI has one plan at a dollar a month, so there is no feature held back for a higher tier — and an unpaid account still opens and exports every vault it already has.
• AlternativeTo's description of CryptPad does not mention Markdown, so check what format your notes end up in before you fill it up. SumizAI writes standard .md files to a folder you picked, and an unpaid account can still export all of them.
• CryptPad advertises encryption. SumizAI answers the same worry a different way: on the desktop the notes never leave your disk, and the material a question sends to the model is capped at the table of contents plus at most five notes — and the app shows you which five it used.
• CryptPad can be self-hosted. SumizAI has nothing to host on the desktop — the vault is a folder on your machine — and if you want the model on your own hardware too, a local Ollama is one of the seven providers it speaks to.
• CryptPad runs in the browser. SumizAI is a desktop and mobile application, and on the desktop the vault is a folder on your own disk rather than a document in someone's cloud.

Which one to pick