End-to-End Encrypted Live Collaboration: Building Collaborative Real-Time Notepads with CRDTs and WebSockets
Photo from Sendly Team / Unsplash
Back to Articles

End-to-End Encrypted Live Collaboration: Building Collaborative Real-Time Notepads with CRDTs and WebSockets

Whether pairing with a remote engineer on a coding interview, sharing ephemeral credentials, or jotting down meeting notes, real-time collaborative text editors feel like magic. When user A types a character, user B sees it appear instantly. But under the hood lies one of computer science's most difficult distributed consensus challenges: how to handle concurrent, out-of-order typing without data corruption.

Operational Transformation (OT) vs CRDTs

Traditional collaborative suites like Google Docs rely on Operational Transformation (OT). In an OT system, all edits must route through a central coordinating server that acts as the single source of truth, ordering keystrokes and transforming coordinate indices.

However, OT systems have a fatal flaw for privacy: the central server must inspect and understand every raw character in order to transform the operational indices. That means zero-knowledge encryption is mathematically impossible with classic OT.

The Modern Privacy-First Alternative: CRDTs

Conflict-free Replicated Data Types (CRDTs) solve this problem by treating every character as an independent, immutable item with a globally unique logical timestamp and position identifier:

  • Commutative Merging: Edits can arrive in any order—delayed by network lag or packet drops—and all peers will still mathematically converge on the exact same document state.
  • Zero-Knowledge Relay: Because the server doesn't need to transform indices, peer updates can be encrypted in the browser with AES-GCM-256 before leaving your computer. The relay server sees only scrambled ciphertext payloads.

Ephemeral, Self-Destructing Pads

In high-security environments, notes should not persist forever on corporate cloud drives. Tools like the Sendly Collaborative Live Notepad pair real-time WebSockets with client-side synchronization and instant room termination. When all peers leave the room, the temporary pad state is immediately scrubbed from memory, leaving zero residual footprint for data collectors to scrape.