---
id: pycrypto
version: "2.6.1"
license: Public domain
license_treatment: permissive
maintenance: abandoned
---

# pycrypto — Cryptographic modules for Python.

License: permissive · Maintenance: abandoned · Downloads: 8.5M/mo

## What it is and what it does

PyCrypto is a collection of cryptographic primitives for Python, providing secure hash functions, symmetric ciphers (AES, DES), asymmetric algorithms (RSA, ElGamal), and a cryptographically secure random number generator. It was designed to make adding new cryptographic modules straightforward and was considered production-stable at release.

The package has been abandoned since 2014-06-20 and receives no maintenance. While it remains downloadable and installable, it carries four known security vulnerabilities and lacks support for modern Python versions and security practices. Installation requires a C compiler and Python development headers, adding friction to deployment.

Use it for:

- Legacy systems or applications that already depend on pycrypto and cannot be migrated to newer libraries.
- Educational projects learning cryptographic algorithms where the implementation details matter more than production security.
- Prototyping public-key algorithms in Python where arbitrary-length integer support is needed.
- Encrypting data in daemons or servers where mutual authentication between clients and servers is required.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Provides cryptographic hash functions (SHA256, RIPEMD160) and symmetric/asymmetric encryption algorithms (AES, DES, RSA, ElGamal) plus a cryptographically secure random number generator.

No. Do not install pycrypto for new projects. The package is abandoned, carries four known vulnerabilities (GHSA-6528-wvf6-f6qg, GHSA-cq27-v7xp-c356, PYSEC-2017-94, PYSEC-2018-97), and has not been maintained for 4438 days. High install friction compounds the risk. For legacy code only.

## Install

pip install pycrypto
uv add pycrypto
poetry add pycrypto

## Installing pycrypto

Before you install: High install friction: requires compilation of C extensions. Package is abandoned as of 2014-06-20 with no maintenance for 4438 days. Strongly consider using actively maintained alternatives instead.

License in practice: Public domain license permits unrestricted use, modification, and distribution without attribution requirements.

Quickstart:

pip install pycrypto==2.6.1
from Crypto.Hash import SHA256
hash = SHA256.new()
hash.update(b'message')
print(hash.digest())

Requires C compiler and Python development headers (python-dev on Debian/Ubuntu, python2-devel on Red Hat). Will fail to build on systems without compilation tools.

Verify before relying:

- Whether the 4 known vulnerabilities (GHSA-6528-wvf6-f6qg, GHSA-cq27-v7xp-c356, PYSEC-2017-94, PYSEC-2018-97) remain exploitable in version 2.6.1.
- Current status of Python 3 compatibility given the package's age and evolution since first release 2010-12-17.
- Whether compilation succeeds on modern systems with current toolchains.
- Availability of drop-in replacement packages for new projects.

## Package facts

- License: Public domain (permissive)
- Python support: unspecified
- Install friction: high
- Maintenance: abandoned
- Downloads: 8.5M/month (top 5,000 on PyPI)
- Known vulnerabilities: 4

## Tags

python cryptography toolkit, AES encryption library, SHA256 hash functions, RSA public key cryptography, secure random number generator, symmetric encryption python, cryptographic algorithms, abandoned, high-install-friction, security-vulnerabilities

[View on SkillFed](https://skillfed.io/packages/pycrypto) · [View on PyPI](https://pypi.org/project/pycrypto/)