Packages
PyKCS11 provides a Python wrapper around the PKCS#11 cryptographic interface standard, enabling Python applications to interact with hardware security modules, smart cards, and other cryptographic tokens.
Python client library and command-line tool for interacting with OpenStack Barbican's Key Management API to store, retrieve, and manage encrypted secrets.
Python bindings for the scrypt key derivation function, enabling password-based encryption and decryption with tunable time costs to resist brute-force attacks.
However, consider whether argon2 or PBKDF2 alternatives better suit your threat model—scrypt's time-cost model is effective but less commonly recommended for new…
Generates mnemonics, seeds, private/public keys, and addresses for multiple cryptocurrencies using BIP and SLIP standards, supporting Bitcoin, Ethereum, Cardano, Monero, Polkadot, Solana, and many others.
Install it if you are building wallet software or integrating blockchain address generation into an application.
PyHPKE implements HPKE (Hybrid Public Key Encryption) as defined in RFC 9180, providing authenticated encryption with public-key cryptography for sender-recipient message exchange.
However, note that it has not been formally audited—do not use it for high-security applications without independent security review.
Pure Python implementation of SSL/TLS protocols (SSLv3.0, TLS 1.0–1.3) with support for modern ciphers, key exchange methods, and certificate types, optionally accelerated by external crypto libraries.
Provides pure Python implementations of curve25519 scalar multiplication operations for Elliptic Curve Diffie-Hellman key exchange and shared secret derivation.
Install only if you need pure Python for educational purposes or an environment where compiled dependencies are impossible; otherwise, use a maintained cryptographic…
Creates and verifies ALTCHA proof-of-work challenges using key derivation functions like PBKDF2, Argon2id, and scrypt to defend against automated attacks.
Install it if you need ALTCHA challenge generation and verification; the API is straightforward and the documentation includes working examples.
Generates strong, memorable passphrases by randomly selecting words from built-in or custom word lists, with options to constrain word length, add delimiters, apply case rules, and enforce acrostic patterns.
xxtea is a Python extension that implements the XXTEA block cipher algorithm, providing functions to encrypt and decrypt data with a 128-bit key using a non-standard 4-byte PKCS#7 padding scheme.
However, be aware that its non-standard padding makes output incompatible with other XXTEA libraries; use only if interoperability with this specific implementation…
Read, validate, create, and sign C2PA manifest data in media files to establish content authenticity and provenance.
Galois extends NumPy arrays to perform arithmetic operations over finite fields (Galois fields), enabling efficient computation in GF(p^m) with a NumPy-compatible interface.
The non-constant-time implementation is explicitly documented as unsuitable for production security but appropriate for research and education, so install only if…
Provides TLS/SSL connections using pre-shared key (PSK) authentication instead of certificates, with support for Python 3.8 through 3.12.
However, the repository is dormant (last commit February 2024); verify that security updates will be available if your use case requires active maintenance.
ECPy is a pure Python elliptic curve library providing ECDSA, EdDSA (Ed25519), ECSchnorr, and Borromean signature schemes, along with elliptic curve point operations.
However, for production systems handling sensitive data, consider whether the aging maintenance (last release October 2020) and lack of recent security updates pose…
Provides Python bindings to the tiny-bip39 Rust library for generating, validating, and converting BIP39 mnemonics to cryptographic seeds, with support for multiple languages.
Provides Python bindings to the ed25519-zebra Rust crate for Ed25519 digital signature operations—key derivation, signing, and verification.
Install it if your use case requires deterministic Ed25519 operations; skip it if you prefer pure-Python alternatives.
M2Crypto wraps OpenSSL via SWIG to provide Python access to cryptographic primitives (RSA, DSA, AES, HMAC), TLS client/server implementation, and HTTPS extensions.
Verifies Auth0-issued access tokens and secures Python APIs with Bearer and DPoP authentication schemes, automatically detecting and validating token types.
Install it if you are building a Python API that needs to validate Auth0 tokens; skip it if you use a different identity provider or do not require server-side token…
A pure-Python implementation of the scrypt password-based key derivation function that hashes passwords and encrypts/decrypts files using the scrypt algorithm.
A pure Python implementation of the Fernet symmetric encryption specification, providing token-based authenticated encryption without compiled C dependencies.
No, not for new projects.
Provides a high-level Python interface to PKCS#11 (Cryptoki) for interacting with hardware security modules and smartcards, supporting symmetric encryption, asymmetric cryptography, key generation, and signing operations.
Python bindings to libsodium's NaCl cryptography library, providing both low-level ctypes access and high-level encryption classes for authenticated encryption, signing, and key exchange.
However, the aging maintenance status (last release 2023, infrequent commits) means you should verify that libsodium availability and the package's feature set meet…
PyKMIP implements the KMIP protocol for managing cryptographic keys and related objects (certificates, passwords, data blobs) with a KMIP-compliant server, supporting the full CRUD lifecycle of key management operations.
However, install it only if you need KMIP protocol support and are comfortable with dormant maintenance: verify that version 0.10.0 works with your target Python…
Provides fast elliptic curve digital signature operations (signing and verification) using NIST and Certicom curves, with no nonce reuse and constant-time point multiplication to mitigate timing attacks.
However, the author cautions against using it for security-critical applications without additional review—use an audited library like libsodium or cryptography for…
Implements BIP 32 hierarchical deterministic (HD) wallet key derivation for Bitcoin, allowing you to generate extended private and public keys from a seed or master key using standard derivation paths.
SOPSy wraps the SOPS command-line tool to encrypt, decrypt, and manage secrets in YAML and JSON files from Python code.
However, be aware that the repository is archived and abandoned—use it only if you are comfortable maintaining it yourself or if your SOPS version and Python…
Builds and validates TLS certificate chains by fetching missing intermediate certificates via the AIA (Authority Information Access) extension, working around CPython issue 18617 where servers don't provide the full chain.
However, its pre-alpha status and dormant maintenance (last release 2021-11-27) mean no active support or updates; use it as a workaround, not a long-term solution.
Pure Python implementation of DES and Triple DES encryption algorithms, supporting DES-EDE3 with a 24 byte key and DES-EDE2 with a 16 byte key.
Implements NIST FF3 and FF3-1 format-preserving encryption (FPE) algorithms to encrypt data while preserving its format—digits remain digits, custom alphabets remain within their alphabet.
No—not for new production systems.
Encrypts and decrypts files and binary streams using AES256-CBC, compatible with the AES Crypt file format (version 2).
Install it if you are not expecting active security updates or bug fixes; avoid it if you require ongoing support or are encrypting data where file-size tampering is…
Adds DTLS (Datagram Transport Layer Security) support to Python by extending the standard library's ssl module to work with UDP sockets, providing encryption and authentication for datagram-based communication.
However, do not use it if you require active security updates or compatibility with Python versions beyond 3.6—the last release was 2020-11-06 and the repository…
Reads and writes Ansible vault-encrypted YAML files programmatically, allowing you to load encrypted vault data and dump data back to encrypted vault format.
However, the GPL-3.0-or-later copyleft license means you cannot use it in proprietary closed-source projects without licensing the entire work under GPL.
Wraps Python's cryptography library to add transparent field-level encryption to Django models, and provides a drop-in replacement for Django's own cryptographic primitives.
However, be aware that the last release was in April 2022; if you require support for newer Django versions or active maintenance, evaluate whether the dormant status…
PySETO implements PASETO (Platform-Agnostic SEcurity TOkens) and PASERK (Platform-Agnostic Serialized Keys) standards in Python, supporting all protocol versions (v1–v4) for both public-key signing and symmetric authenticated encryption.
Install it if you need stateless token authentication or secure key serialization and prefer a standards-based alternative to JWT or custom token schemes.
cryptg provides a native Python extension that implements AES-IGE encryption, the cipher mode used by Telegram's MTProto protocol.
Produces and verifies cryptographic signatures for TrueLayer API requests and webhooks using PEM keys and JWKS.
Install it if you are integrating with TrueLayer's API and need to sign requests or verify webhooks; it is the standard tool for this task in Python.
Encodes and decodes byte arrays using the Base58Check scheme, a binary-to-text encoding used primarily for Bitcoin addresses and similar cryptographic identifiers.
However, note that no releases have been published since 2018, so verify that it meets your Python version requirements and handles edge cases your use case requires…
Provides Python bindings to Ed25519 digital signatures using BLAKE2b instead of SHA512, enabling signature creation and verification compatible with NANO and similar systems.
Generates and verifies Luhn check digits for digit strings, commonly used to validate credit card numbers and similar identifiers.
However, it is abandoned and has not been updated since 2015-06-23—install only if you are confident the Luhn algorithm implementation is correct for your use case…
Endesive signs and verifies digital signatures in PDF, S/MIME email, XML, and plain-text documents using cryptographic keys and certificates.