python-pkcs11

What it is and what it does

python-pkcs11 is a Pythonic wrapper around the PKCS#11 (Cryptoki) standard that abstracts the complexity of interacting with hardware security modules and smartcards. It provides a high-level API for cryptographic operations including AES, DES3, RSA, DSA, ECDSA, and Diffie-Hellman key exchange, with support for key generation, encryption, decryption, signing, and verification. The library includes utility functions to convert between PKCS#11 data structures and common interchange formats like PKCS#1 and X.509.

The package is designed to follow the logical structure of an HSM with sensible defaults for obscure parameters. Many APIs accept iterables and act as generators, allowing you to stream large data blocks for symmetric encryption. It supports modern Python versions (3.10 through 3.14) and is tested against SoftHSMv2 and opencryptoki in CI, though historical testing against multiple commercial HSM platforms is no longer actively maintained.

Use it for:

• Generate and manage cryptographic keys on a hardware security module or smartcard from Python applications
• Encrypt and decrypt data using symmetric algorithms (AES, DES3) stored on HSM tokens
• Sign and verify data using RSA, DSA, or ECDSA keys resident on a smartcard or HSM
• Perform key agreement operations (Diffie-Hellman, ECDH) for establishing shared session keys
• Convert cryptographic material between PKCS#11 and standard formats (PKCS#1, X.509) for interoperability

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Provides a high-level Python interface to PKCS#11 (Cryptoki) for interacting with hardware security modules and smartcards, supporting symmetric encryption, asymmetric cryptography, key generation, and signing operations.

Yes, if you need to work with PKCS#11 devices (HSMs or smartcards) from Python. The package is actively maintained, has no known vulnerabilities, uses a permissive MIT license, and supports current Python versions. Install friction is moderate due to compiled wheels, but pre-built distributions are available for common platforms. The main caveat is that you must have a compatible PKCS#11 module installed and configured separately.

Install

python-pkcs11 on PyPI

pip install python-pkcs11

uv add python-pkcs11

poetry add python-pkcs11

Installing python-pkcs11

Before you install

Medium install friction due to compiled wheels for multiple Python versions and platforms. Active maintenance with a recent release (35 days old) and ongoing repository activity, though historical CI against multiple HSM platforms is no longer maintained.

License in practice

MIT license permits unrestricted use, modification, and distribution in both open and closed-source projects with minimal restrictions.

Quickstart

import os
import pkcs11

lib = pkcs11.lib(os.environ['PKCS11_MODULE'])
token = lib.get_token(token_label='DEMO')
with token.open(user_pin='1234') as session:
    key = session.generate_key(pkcs11.KeyType.AES, 256)
    iv = session.generate_random(128)
    crypttext = key.encrypt(b'INPUT DATA', mechanism_param=iv)

Requires a PKCS#11 module library (e.g., SoftHSMv2, opencryptoki, or a hardware HSM driver) and the PKCS11_MODULE environment variable to be set to its path.

Verify before relying

• Current test coverage against actual HSM hardware beyond SoftHSMv2 and opencryptoki baseline
• Performance characteristics for large data streaming with symmetric encryption
• Compatibility status with PKCS#11 implementations not listed in the tested compatibility table

Package facts

Evidence: python_pkcs11-0.9.5-cp310-cp310-macosx_10_9_universal2.whl; python_pkcs11-0.9.5-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl; python_pkcs11-0.9.5-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl; python_pkcs11-0.9.5-cp310-cp310-musllinux_1_2_aarch64.whl; python_pkcs11-0.9.5-cp310-cp310-musllinux_1_2_x86_64.whl; python_pkcs11-0.9.5-cp310-cp310-win_amd64.whl; python_pkcs11-0.9.5-cp311-cp311-macosx_10_9_universal2.whl; python_pkcs11-0.9.5-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl; python_pkcs11-0.9.5-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl; python_pkcs11-0.9.5-cp311-cp311-musllinux_1_2_aarch64.whl; python_pkcs11-0.9.5-cp311-cp311-musllinux_1_2_x86_64.whl; python_pkcs11-0.9.5-cp311-cp311-win_amd64.whl; python_pkcs11-0.9.5-cp312-cp312-macosx_10_13_universal2.whl; python_pkcs11-0.9.5-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl; python_pkcs11-0.9.5-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl; python_pkcs11-0.9.5-cp312-cp312-musllinux_1_2_aarch64.whl; python_pkcs11-0.9.5-cp312-cp312-musllinux_1_2_x86_64.whl; python_pkcs11-0.9.5-cp312-cp312-win_amd64.whl; python_pkcs11-0.9.5-cp313-cp313-macosx_10_13_universal2.whl; python_pkcs11-0.9.5-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl

Tags

More Cryptography packages