ecdsa

ECDSA cryptographic signature library (pure python)

ecdsa Permissive license MIT Active ★ 974 v0.19.2 released 2026-03-26

Install

ecdsa on PyPI

pip

pip install ecdsa

uv

uv add ecdsa

poetry

poetry add ecdsa

Package facts

License	MIT (permissive)
Python support	supports the current Python release (!=3.0.,!=3.1.,!=3.2.,!=3.3.,!=3.4.,!=3.5.,>=2.6)
Install friction	low — pure-Python wheel
Runtime dependencies	1 — six
Maintenance	actively maintained — 140 days since the last release
Last repo commit	2026-06-08
First released	2010-10-16
Popularity	one of the top 1,000 most-downloaded packages on PyPI (30-day window, as of 2026-08-13)
Known vulnerabilities	2 — GHSA-wj6h-64fc-37mp, PYSEC-2026-1325

Evidence: ecdsa-0.19.2-py2.py3-none-any.whl

Programming Language :: PythonProgramming Language :: Python :: 2Programming Language :: Python :: 2.6Programming Language :: Python :: 2.7Programming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.6Programming Language :: Python :: 3.7Programming Language :: Python :: 3.8Programming Language :: Python :: 3.9

About ecdsa

from the package's own PyPI description — quoted content, verbatim

Pure-Python ECDSA and ECDH

GitHub CI (image) Documentation Status (image) Coverage Status (image) condition coverage (image) mutation score (image) CodeQL (image) Latest Version (image) ![Code style:...

Read as markdown · JSON record · Source repository · Homepage

AI interpretation — verify before relying

AI-generated interpretation of the package facts above; every digit, version, license, or vulnerability id it cites is grounded in the facts already shown on this page

Pure-Python implementation of elliptic curve cryptography (ECDSA, EdDSA, ECDH) for key generation, digital signatures, and shared secret derivation across NIST, Brainpool, and SEC curves.

Low friction: single pure-Python dependency (six) and distributed as a wheel. Actively maintained with recent release 140 days ago and ongoing repository activity.

MIT license permits unrestricted use, modification, and distribution in both open-source and proprietary contexts with minimal obligations.

Usage

pip install ecdsa
from ecdsa import SigningKey
sk = SigningKey.generate()
message = b'test'
signature = sk.sign(message)

The package's own documentation warns against production use; see Security section in the project README.

Verdict: Actively maintained, permissively licensed, and easy to install, but carries two known security vulnerabilities (GHSA-wj6h-64fc-37mp, PYSEC-2026-1325) and an explicit upstream warning against production deployment. Suitable for educational, testing, or non-critical cryptographic tasks only.

Needs verification

Nature and severity of the two disclosed vulnerabilities and whether patches are available in version 0.19.2
Whether the production-use warning reflects fundamental design limitations or specific attack vectors
Performance impact of optional gmpy2 dependency and whether it is recommended for typical workloads

elliptic curve cryptography pythonECDSA digital signature librarypure python ECC implementationECDH key exchangeEdDSA Ed25519 signingsecp256k1 bitcoin curvescryptographic key generation