Collabora Online vs CryptPad: Which to Self-Host?
Quick Verdict
CryptPad is the better choice if privacy is non-negotiable — its zero-knowledge encryption means even the server admin can’t read user documents. Collabora Online wins for teams already running Nextcloud who need strong Microsoft Office file compatibility and a familiar editing experience. They solve different problems: Collabora is a document editor that plugs into your file platform, CryptPad is an encrypted collaboration suite that replaces both editor and file platform.
How They Work
Collabora Online (CODE) is a headless LibreOffice instance running on your server. It renders documents server-side and streams the result to the browser via WOPI. It needs a host platform — Nextcloud, ownCloud, or Seafile — to manage files. You don’t use Collabora standalone; it’s always a backend for another application.
CryptPad is a standalone web application. Users create accounts, make documents, and share them — all within CryptPad itself. Encryption happens in the browser before data reaches the server. No external platform required, no integration needed.
| Aspect | Collabora Online (CODE) | CryptPad |
|---|---|---|
| Architecture | Server-side LibreOffice rendering via WOPI | Client-side app with E2E encryption |
| Standalone | No — requires Nextcloud or WOPI host | Yes — self-contained |
| Encryption | At-rest only (depends on host platform) | End-to-end, zero-knowledge |
| MS Office formats | Native .docx/.xlsx/.pptx editing | Import/export only — native format is internal |
| Document types | Documents, spreadsheets, presentations | Documents, spreadsheets, presentations, Kanban, whiteboard, forms, code |
| Real-time collab | Yes (via WOPI host) | Yes (built-in) |
| Docker image | collabora/code:25.04.9.1.1 | cryptpad/cryptpad:2024.12.1 |
| RAM (idle) | ~1.3 GB | ~150 MB |
| RAM (recommended) | 2-4 GB | 512 MB-2 GB |
| License | MPL-2.0 (CODE) | AGPL-3.0 |
| Database | None (stateless renderer) | None (file-based) |
| Special requirement | Separate domain + reverse proxy + WOPI host | Two subdomains (security sandbox) |
Document Editing Experience
Collabora’s editing interface is essentially LibreOffice in a browser. The toolbar layout, keyboard shortcuts, and rendering engine are all LibreOffice. If your team uses .docx files from clients, Collabora handles them with better fidelity than any other self-hosted option. Track changes, comments, and complex formatting survive round-trips between Microsoft Office and Collabora.
CryptPad’s editors are purpose-built web applications. The rich text editor uses CKEditor, the spreadsheet component is OnlyOffice’s sheet engine under license, and the presentation tool is custom. The editing experience is functional but simpler than Collabora’s. Complex .docx files with heavy formatting will lose some fidelity on import. The trade-off: everything you type is encrypted before it leaves the browser.
Resource Usage
Collabora is heavy. The LibreOffice rendering engine loads into memory for each document opened, with a baseline of ~1.3 GB even idle. Each concurrent editing session adds roughly 100 MB. A server handling 10 simultaneous users needs 4+ GB dedicated to Collabora alone. The image itself is over 1 GB compressed.
CryptPad is lightweight. The server is a Node.js process that stores encrypted blobs — it doesn’t render anything. Idle RAM sits around 150 MB, and the application data starts small. The computational work happens in users’ browsers, not on the server. You can run CryptPad comfortably on a VPS with 1 GB of RAM.
| Metric | Collabora Online | CryptPad |
|---|---|---|
| Idle RAM | ~1.3 GB | ~150 MB |
| Per-user overhead | ~100 MB | Minimal (server stores blobs) |
| Docker image size | ~1.2 GB | ~400 MB |
| CPU usage (idle) | Low | Low |
| CPU usage (editing) | Moderate-High (server renders) | Low (client renders) |
| Disk growth | Minimal (files on host platform) | Moderate (encrypted blobs) |
Setup Complexity
Collabora needs: a running Nextcloud (or other WOPI host), a separate subdomain for Collabora, a reverse proxy that correctly handles WebSocket upgrade and WOPI discovery, and environment variables that whitelist the host domain. Getting the reverse proxy right is the hardest part — Nginx and Traefik each need specific WebSocket and header configurations. The Nextcloud integration also requires installing the Collabora connector app and configuring the WOPI URL.
CryptPad needs: two subdomains (main domain + sandbox domain for iframe isolation), a correctly configured config.js, and volume mounts for data persistence. The dual-domain requirement is CryptPad’s security model — the sandbox origin prevents XSS attacks from accessing authentication tokens. Setup is simpler than Collabora’s (no external platform dependency), but the two-domain requirement trips up first-time deployers.
Privacy and Security
This is the fundamental differentiator.
Collabora encrypts nothing by default. Documents are rendered server-side in plaintext. The admin can read any document. Security depends entirely on the host platform’s access controls and your server’s disk encryption.
CryptPad encrypts everything client-side using the browser’s Web Crypto API. The server never sees plaintext. Even if the server is compromised, attackers get encrypted blobs. The admin cannot read documents, reset passwords, or recover data. This is genuine zero-knowledge architecture — not marketing copy.
The trade-off: if a CryptPad user loses their password, their data is gone. There’s no recovery mechanism because there’s no server-side decryption key. Collabora (via Nextcloud) supports admin password resets and file recovery.
Use Cases
Choose Collabora Online If…
- You already run Nextcloud and want native document editing
- Your team exchanges .docx/.xlsx files with external parties
- Formatting fidelity matters (legal documents, complex spreadsheets)
- You need admin oversight of all documents (compliance, backup)
- Your server has 4+ GB of RAM to spare
Choose CryptPad If…
- Privacy is the primary requirement — you genuinely cannot access user data
- You want a standalone collaboration suite without Nextcloud
- Your server has limited resources (1 GB RAM is enough)
- You need more than documents — CryptPad also handles Kanban boards, whiteboards, forms, and code editing
- Your users create content natively in CryptPad rather than importing Office files
Final Verdict
For most self-hosters already running Nextcloud, Collabora Online is the practical choice. The LibreOffice-based rendering gives the best Microsoft Office compatibility available in self-hosted software, and the Nextcloud integration makes it the natural document editor for that ecosystem.
For privacy-focused deployments — journalism, legal, healthcare, or anyone who genuinely needs the server admin locked out — CryptPad is the only real option. No other self-hosted office suite offers true zero-knowledge encryption. The simpler resource footprint is a bonus.
If you don’t run Nextcloud and don’t specifically need E2E encryption, consider ONLYOFFICE as a middle ground — it’s standalone-capable, has excellent Office format support, and integrates with multiple platforms.
Related
Get self-hosting tips in your inbox
New guides, comparisons, and setup tutorials — delivered weekly. No spam.