eacer/docuscrypt repository overview

⁠DocusCrypt

A small, self-hosted web app for encrypting and decrypting password-protected documents: modern Office files (.docx, .xlsx, .pptx) and PDFs.

Source: https://github.com/AceRodnel14/docuscrypt⁠

⁠Features

• Encrypt or decrypt with one toggle. Type a password or generate a random one.
• Picks the right engine automatically from what the file actually contains, not just its name. A PDF renamed to .docx gets a clear error instead of a cryptic failure.
• Stateless and private. Files are processed in memory, one request at a time. Nothing is stored, and nothing is shared between requests.
• Small and locked down. Distroless base image, runs as non-root, no shell inside the container.

⁠Format support

Older 97–2003 Office files are no longer supported in v2. Save them as .docx / .xlsx / .pptx first. Files encrypted by the Python version (v1) still decrypt fine.

For PDFs, the single password you enter is used as both the open password and the permissions password, so anyone who has it gets the full document.

⁠Quick start

docker run --rm -p 8000:8000 eacer/docuscrypt

Then open http://localhost:8000⁠.

No environment variables or volumes are needed.

⁠Deployment notes

• Port: 8000
• Health check: GET /healthz returns {"status":"ok"}. The image has no shell, so use HTTP liveness/readiness probes, not exec ones.
• Graceful shutdown: in-flight requests finish on SIGTERM, so it works well with Kubernetes and scale-to-zero setups like KEDA.
• No TLS or login built in. It's meant for a trusted network. Put it behind a reverse proxy such as Traefik if you need HTTPS or access control.

⁠API

⁠Built with

• spine⁠: Office encryption
• pdfcpu⁠: PDF encryption
• mscfb⁠: reads the container format encrypted Office files are stored in