---
title: Paper
emoji: 📝
colorFrom: purple
colorTo: pink
sdk: docker
pinned: false
---

# Paper ✨

A minimal, secure notepad for temporary notes. Zero tracking, zero accounts — just encrypted notes.

## Features

- 🔐 **Client-side encryption** — Your password never leaves your browser
- 🗑️ **Auto-delete** — Notes removed after 2 days of inactivity
- 🌐 **Access anywhere** — Same password = same note, from any device
- 🚫 **No tracking** — No cookies, no analytics, no accounts

## How It Works

```
┌─────────────────┐         ┌─────────────────┐
│     Browser     │         │     Server      │
├─────────────────┤         ├─────────────────┤
│                 │         │                 │
│  Password ──────┼─► SHA-256 Hash (16 char)  │
│        │        │         │        │        │
│        ▼        │         │        ▼        │
│  PBKDF2 Key     │         │  File ID        │
│  (250k rounds)  │         │  (no password)  │
│        │        │         │                 │
│        ▼        │         │                 │
│  AES-GCM        │         │                 │
│  Encrypt/Decrypt│◄───────►│  Store/Load     │
│                 │         │  Encrypted Blob │
└─────────────────┘         └─────────────────┘
```

**Key points:**
- Password → PBKDF2 → AES-256-GCM key (client only)
- Password → SHA-256 → File identifier (sent to server)
- Server stores only: encrypted content + random salt
- Server never sees: password or decrypted content

## Architecture

```
Paper/
├── index.html      # Single-page app (HTML + CSS + JS)
├── main.py         # Flask backend
├── Dockerfile      # Container setup
└── requirements.txt
```

### Frontend (`index.html`)
- Single HTML file with embedded CSS and JavaScript
- Crypto API for AES-GCM encryption and PBKDF2 key derivation
- Auto-save with debounce (1.5s after typing stops)
- Dark theme with colorful accents

### Backend (`main.py`)
- Flask server with CORS support
- Two endpoints: `/api/load` and `/api/save`
- File-based storage (configurable via `DATA_DIR`)
- Auto-cleanup: files older than 2 days or when storage exceeds limit

## Environment Variables

| Variable | Default | Description |
|----------|---------|-------------|
| `DATA_DIR` | `/tmp` | Storage directory |
| `AGE_LIMIT_DAYS` | `2` | Days before auto-delete |
| `MAX_TOTAL_SIZE_MB` | `100` | Max storage size |
| `MAX_CONTENT_SIZE_MB` | `10` | Max note size |

## Run Locally

```bash
# Install dependencies
pip -r requirements.txt

# Start server
python main.py
```

Open http://localhost:7860

## Deploy

### Docker
```bash
docker build -t paper .
docker run -p 7860:7860 paper
```

## Security Notes

- All encryption happens in your browser
- Password is never transmitted or stored
- Server cannot decrypt your notes
- Use a strong, memorable password
- No password recovery possible

## License

MIT