python-pkcs11
PKCS#11 support for Python
Decision gist · record as of 2026-08-14
Yes, if you need to work with PKCS#11 devices (HSMs or smartcards) from Python. The package is actively maintained, has no known vulnerabilities, uses a permissive MIT license, and supports current Python versions. Install friction is moderate due to compiled wheels, but pre-built distributions are available for common platforms. The main caveat is that you must have a compatible PKCS#11 module installed and configured separately.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires a PKCS#11 module library (e.g., SoftHSMv2, opencryptoki, or a hardware HSM driver) and the PKCS11_MODULE environment variable to be set to its path.
- Medium install friction due to compiled wheels for multiple Python versions and platforms.
- Active maintenance with a recent release (35 days old) and ongoing repository activity, though historical CI against multiple HSM platforms is no longer maintained.
License · maintenance · safety
MIT (permissive) — MIT license permits unrestricted use, modification, and distribution in both open and closed-source projects with minimal restrictions.
last release 2026-07-10 (35 days) · last repo commit 2026-08-05 · 170 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 234,998 downloads/mo, #9,013 on PyPI
Alternatives
Verify before relying
import os
import pkcs11
lib = pkcs11.lib(os.environ['PKCS11_MODULE'])
token = lib.get_token(token_label='DEMO')
with token.open(user_pin='1234') as session:
key = session.generate_key(pkcs11.KeyType.AES, 256)
iv = session.generate_random(128)
crypttext = key.encrypt(b'INPUT DATA', mechanism_param=iv)- Current test coverage against actual HSM hardware beyond SoftHSMv2 and opencryptoki baseline
- Performance characteristics for large data streaming with symmetric encryption
- Compatibility status with PKCS#11 implementations not listed in the tested compatibility table
What it is and what it does
python-pkcs11 is a Pythonic wrapper around the PKCS#11 (Cryptoki) standard that abstracts the complexity of interacting with hardware security modules and smartcards. It provides a high-level API for cryptographic operations including AES, DES3, RSA, DSA, ECDSA, and Diffie-Hellman key exchange, with support for key generation, encryption, decryption, signing, and verification. The library includes utility functions to convert between PKCS#11 data structures and common interchange formats like PKCS#1 and X.509.
The package is designed to follow the logical structure of an HSM with sensible defaults for obscure parameters. Many APIs accept iterables and act as generators, allowing you to stream large data blocks for symmetric encryption. It supports modern Python versions (3.10 through 3.14) and is tested against SoftHSMv2 and opencryptoki in CI, though historical testing against multiple commercial HSM platforms is no longer actively maintained.
Use it for
- Generate and manage cryptographic keys on a hardware security module or smartcard from Python applications
- Encrypt and decrypt data using symmetric algorithms (AES, DES3) stored on HSM tokens
- Sign and verify data using RSA, DSA, or ECDSA keys resident on a smartcard or HSM
- Perform key agreement operations (Diffie-Hellman, ECDH) for establishing shared session keys
- Convert cryptographic material between PKCS#11 and standard formats (PKCS#1, X.509) for interoperability
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need to work with PKCS#11 devices (HSMs or smartcards) from Python.
The package is actively maintained, has no known vulnerabilities, uses a permissive MIT license, and supports current Python versions. Install friction is moderate due to compiled wheels, but pre-built distributions are available for common platforms. The main caveat is that you must have a compatible PKCS#11 module installed and configured separately.
Install
python-pkcs11 on PyPI
Before you install
Medium install friction due to compiled wheels for multiple Python versions and platforms. Active maintenance with a recent release (35 days old) and ongoing repository activity, though historical CI against multiple HSM platforms is no longer maintained.
Requires a PKCS#11 module library (e.g., SoftHSMv2, opencryptoki, or a hardware HSM driver) and the PKCS11_MODULE environment variable to be set to its path.
License in practice
MIT license permits unrestricted use, modification, and distribution in both open and closed-source projects with minimal restrictions.
Quickstart
import os
import pkcs11
lib = pkcs11.lib(os.environ['PKCS11_MODULE'])
token = lib.get_token(token_label='DEMO')
with token.open(user_pin='1234') as session:
key = session.generate_key(pkcs11.KeyType.AES, 256)
iv = session.generate_random(128)
crypttext = key.encrypt(b'INPUT DATA', mechanism_param=iv)Verify before relying
- Current test coverage against actual HSM hardware beyond SoftHSMv2 and opencryptoki baseline
- Performance characteristics for large data streaming with symmetric encryption
- Compatibility status with PKCS#11 implementations not listed in the tested compatibility table
Package facts
| License | MIT permissive |
| Python support | Supports the current Python release >=3.10 |
| Install friction | Medium. Platform-specific wheel |
| Runtime dependencies | 1 packageasn1crypto |
| Maintenance | Actively maintained 35 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 234,998 / month, #9,013 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Programming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Topic :: Security :: Cryptography |
Evidence: python_pkcs11-0.9.5-cp310-cp310-macosx_10_9_universal2.whl; python_pkcs11-0.9.5-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl; python_pkcs11-0.9.5-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl; python_pkcs11-0.9.5-cp310-cp310-musllinux_1_2_aarch64.whl; python_pkcs11-0.9.5-cp310-cp310-musllinux_1_2_x86_64.whl; python_pkcs11-0.9.5-cp310-cp310-win_amd64.whl; python_pkcs11-0.9.5-cp311-cp311-macosx_10_9_universal2.whl; python_pkcs11-0.9.5-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl; python_pkcs11-0.9.5-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl; python_pkcs11-0.9.5-cp311-cp311-musllinux_1_2_aarch64.whl; python_pkcs11-0.9.5-cp311-cp311-musllinux_1_2_x86_64.whl; python_pkcs11-0.9.5-cp311-cp311-win_amd64.whl; python_pkcs11-0.9.5-cp312-cp312-macosx_10_13_universal2.whl; python_pkcs11-0.9.5-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl; python_pkcs11-0.9.5-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl; python_pkcs11-0.9.5-cp312-cp312-musllinux_1_2_aarch64.whl; python_pkcs11-0.9.5-cp312-cp312-musllinux_1_2_x86_64.whl; python_pkcs11-0.9.5-cp312-cp312-win_amd64.whl; python_pkcs11-0.9.5-cp313-cp313-macosx_10_13_universal2.whl; python_pkcs11-0.9.5-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “PKCS#11 Python wrapper”
- python-pkcs11Provides a high-level Python interface to PKCS#11 (Cryptoki) for…
- PyKCS11PyKCS11 provides a Python wrapper around the PKCS#11 cryptographic…
- pyHankopyHanko is a Python library for adding, validating, and managing…
Give your agent the search over MCP, or paste the wish link into any chat.
More Cryptography packages
Certifi provides Mozilla's curated collection of root SSL certificates for Python applications to validate TLS hosts and verify certificate trustworthiness.
cryptography provides cryptographic recipes and low-level primitives for symmetric encryption, message digests, key derivation, and other common cryptographic algorithms in Python.
Pure-Python RSA encryption, decryption, signing, and key generation following PKCS#1 v1.5, with command-line and library interfaces.
pyOpenSSL wraps OpenSSL's SSL/TLS functionality for Python, providing high-level connection objects and certificate handling through a Python-friendly interface around OpenSSL's cryptographic operations.
Provides Microsoft Entra ID token-based authentication for Azure SDK clients through a set of TokenCredential implementations that handle OAuth flows and managed identity support.
PyNaCl provides Python bindings to libsodium for digital signatures, secret-key and public-key encryption, hashing, message authentication, and password-based key derivation.
See also hsms · PyKCS11 · diffiehellmanlib · pyscard · pyHanko · aes-pkcs5 · pycryptodomex · securesystemslib · PGPy13 · homeconnect-websocket