pycrypto

What it is and what it does

PyCrypto is a collection of cryptographic primitives for Python, providing secure hash functions, symmetric ciphers (AES, DES), asymmetric algorithms (RSA, ElGamal), and a cryptographically secure random number generator. It was designed to make adding new cryptographic modules straightforward and was considered production-stable at release.

The package has been abandoned since 2014-06-20 and receives no maintenance. While it remains downloadable and installable, it carries four known security vulnerabilities and lacks support for modern Python versions and security practices. Installation requires a C compiler and Python development headers, adding friction to deployment.

Use it for:

• Legacy systems or applications that already depend on pycrypto and cannot be migrated to newer libraries.
• Educational projects learning cryptographic algorithms where the implementation details matter more than production security.
• Prototyping public-key algorithms in Python where arbitrary-length integer support is needed.
• Encrypting data in daemons or servers where mutual authentication between clients and servers is required.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Provides cryptographic hash functions (SHA256, RIPEMD160) and symmetric/asymmetric encryption algorithms (AES, DES, RSA, ElGamal) plus a cryptographically secure random number generator.

No. Do not install pycrypto for new projects. The package is abandoned, carries four known vulnerabilities (GHSA-6528-wvf6-f6qg, GHSA-cq27-v7xp-c356, PYSEC-2017-94, PYSEC-2018-97), and has not been maintained for 4438 days. High install friction compounds the risk. For legacy code only.

Install

pycrypto on PyPI

pip install pycrypto

uv add pycrypto

poetry add pycrypto

Installing pycrypto

Before you install

High install friction: requires compilation of C extensions. Package is abandoned as of 2014-06-20 with no maintenance for 4438 days. Strongly consider using actively maintained alternatives instead.

License in practice

Public domain license permits unrestricted use, modification, and distribution without attribution requirements.

Quickstart

pip install pycrypto==2.6.1
from Crypto.Hash import SHA256
hash = SHA256.new()
hash.update(b'message')
print(hash.digest())

Requires C compiler and Python development headers (python-dev on Debian/Ubuntu, python2-devel on Red Hat). Will fail to build on systems without compilation tools.

Verify before relying

• Whether the 4 known vulnerabilities (GHSA-6528-wvf6-f6qg, GHSA-cq27-v7xp-c356, PYSEC-2017-94, PYSEC-2018-97) remain exploitable in version 2.6.1.
• Current status of Python 3 compatibility given the package's age and evolution since first release 2010-12-17.
• Whether compilation succeeds on modern systems with current toolchains.
• Availability of drop-in replacement packages for new projects.

Package facts

Evidence: pycrypto-2.6.1.tar.gz

Tags

More Cryptography packages