README.md

metadata

title: Paper
emoji: 📝
colorFrom: purple
colorTo: pink
sdk: docker
pinned: false

Paper ✨

A minimal, secure notepad for temporary notes. Zero tracking, zero accounts — just encrypted notes.

Features

• 🔐 Client-side encryption — Your password never leaves your browser
• 🗑️ Auto-delete — Notes removed after 2 days of inactivity
• 🌐 Access anywhere — Same password = same note, from any device
• 🚫 No tracking — No cookies, no analytics, no accounts

How It Works

┌─────────────────┐         ┌─────────────────┐
│     Browser     │         │     Server      │
├─────────────────┤         ├─────────────────┤
│                 │         │                 │
│  Password ──────┼─► SHA-256 Hash (16 char)  │
│        │        │         │        │        │
│        ▼        │         │        ▼        │
│  PBKDF2 Key     │         │  File ID        │
│  (250k rounds)  │         │  (no password)  │
│        │        │         │                 │
│        ▼        │         │                 │
│  AES-GCM        │         │                 │
│  Encrypt/Decrypt│◄───────►│  Store/Load     │
│                 │         │  Encrypted Blob │
└─────────────────┘         └─────────────────┘

Key points:

• Password → PBKDF2 → AES-256-GCM key (client only)
• Password → SHA-256 → File identifier (sent to server)
• Server stores only: encrypted content + random salt
• Server never sees: password or decrypted content

Architecture

Paper/
├── index.html      # Single-page app (HTML + CSS + JS)
├── main.py         # Flask backend
├── Dockerfile      # Container setup
└── requirements.txt

Frontend (index.html)

• Single HTML file with embedded CSS and JavaScript
• Crypto API for AES-GCM encryption and PBKDF2 key derivation
• Auto-save with debounce (1.5s after typing stops)
• Dark theme with colorful accents

Backend (main.py)

• Flask server with CORS support
• Two endpoints: /api/load and /api/save
• File-based storage (configurable via DATA_DIR)
• Auto-cleanup: files older than 2 days or when storage exceeds limit

Environment Variables

Variable	Default	Description
DATA_DIR	/tmp	Storage directory
AGE_LIMIT_DAYS	2	Days before auto-delete
MAX_TOTAL_SIZE_MB	100	Max storage size
MAX_CONTENT_SIZE_MB	10	Max note size

Run Locally

# Install dependencies
pip -r requirements.txt

# Start server
python main.py

Open http://localhost:7860

Deploy

Docker

docker build -t paper .
docker run -p 7860:7860 paper

Security Notes

• All encryption happens in your browser
• Password is never transmitted or stored
• Server cannot decrypt your notes
• Use a strong, memorable password
• No password recovery possible

License

MIT