|
|
--- |
|
|
title: Paper |
|
|
emoji: 📝 |
|
|
colorFrom: purple |
|
|
colorTo: pink |
|
|
sdk: docker |
|
|
pinned: false |
|
|
--- |
|
|
|
|
|
# Paper ✨ |
|
|
|
|
|
A minimal, secure notepad for temporary notes. Zero tracking, zero accounts — just encrypted notes. |
|
|
|
|
|
## Features |
|
|
|
|
|
- 🔐 **Client-side encryption** — Your password never leaves your browser |
|
|
- 🗑️ **Auto-delete** — Notes removed after 2 days of inactivity |
|
|
- 🌐 **Access anywhere** — Same password = same note, from any device |
|
|
- 🚫 **No tracking** — No cookies, no analytics, no accounts |
|
|
|
|
|
## How It Works |
|
|
|
|
|
``` |
|
|
┌─────────────────┐ ┌─────────────────┐ |
|
|
│ Browser │ │ Server │ |
|
|
├─────────────────┤ ├─────────────────┤ |
|
|
│ │ │ │ |
|
|
│ Password ──────┼─► SHA-256 Hash (16 char) │ |
|
|
│ │ │ │ │ │ |
|
|
│ ▼ │ │ ▼ │ |
|
|
│ PBKDF2 Key │ │ File ID │ |
|
|
│ (250k rounds) │ │ (no password) │ |
|
|
│ │ │ │ │ |
|
|
│ ▼ │ │ │ |
|
|
│ AES-GCM │ │ │ |
|
|
│ Encrypt/Decrypt│◄───────►│ Store/Load │ |
|
|
│ │ │ Encrypted Blob │ |
|
|
└─────────────────┘ └─────────────────┘ |
|
|
``` |
|
|
|
|
|
**Key points:** |
|
|
- Password → PBKDF2 → AES-256-GCM key (client only) |
|
|
- Password → SHA-256 → File identifier (sent to server) |
|
|
- Server stores only: encrypted content + random salt |
|
|
- Server never sees: password or decrypted content |
|
|
|
|
|
## Architecture |
|
|
|
|
|
``` |
|
|
Paper/ |
|
|
├── index.html # Single-page app (HTML + CSS + JS) |
|
|
├── main.py # Flask backend |
|
|
├── Dockerfile # Container setup |
|
|
└── requirements.txt |
|
|
``` |
|
|
|
|
|
### Frontend (`index.html`) |
|
|
- Single HTML file with embedded CSS and JavaScript |
|
|
- Crypto API for AES-GCM encryption and PBKDF2 key derivation |
|
|
- Auto-save with debounce (1.5s after typing stops) |
|
|
- Dark theme with colorful accents |
|
|
|
|
|
### Backend (`main.py`) |
|
|
- Flask server with CORS support |
|
|
- Two endpoints: `/api/load` and `/api/save` |
|
|
- File-based storage (configurable via `DATA_DIR`) |
|
|
- Auto-cleanup: files older than 2 days or when storage exceeds limit |
|
|
|
|
|
## Environment Variables |
|
|
|
|
|
| Variable | Default | Description | |
|
|
|----------|---------|-------------| |
|
|
| `DATA_DIR` | `/tmp` | Storage directory | |
|
|
| `AGE_LIMIT_DAYS` | `2` | Days before auto-delete | |
|
|
| `MAX_TOTAL_SIZE_MB` | `100` | Max storage size | |
|
|
| `MAX_CONTENT_SIZE_MB` | `10` | Max note size | |
|
|
|
|
|
## Run Locally |
|
|
|
|
|
```bash |
|
|
# Install dependencies |
|
|
pip -r requirements.txt |
|
|
|
|
|
# Start server |
|
|
python main.py |
|
|
``` |
|
|
|
|
|
Open http://localhost:7860 |
|
|
|
|
|
## Deploy |
|
|
|
|
|
### Docker |
|
|
```bash |
|
|
docker build -t paper . |
|
|
docker run -p 7860:7860 paper |
|
|
``` |
|
|
|
|
|
## Security Notes |
|
|
|
|
|
- All encryption happens in your browser |
|
|
- Password is never transmitted or stored |
|
|
- Server cannot decrypt your notes |
|
|
- Use a strong, memorable password |
|
|
- No password recovery possible |
|
|
|
|
|
## License |
|
|
|
|
|
MIT |
|
|
|
