rsa

Pure-Python RSA implementation

rsa Permissive license Apache-2.0 Abandoned ★ 489 v4.9.1 released 2025-04-16

Install

rsa on PyPI

pip

pip install rsa

uv

uv add rsa

poetry

poetry add rsa

Package facts

License	Apache-2.0 (permissive)
Python support	supports the current Python release (<4,>=3.6)
Install friction	low — pure-Python wheel
Runtime dependencies	1 — pyasn1
Maintenance	abandoned — 484 days since the last release
Last repo commit	2025-04-16 (repository archived)
First released	2008-04-23
Popularity	one of the top 1,000 most-downloaded packages on PyPI (30-day window, as of 2026-08-13)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-13)

Evidence: rsa-4.9.1-py3-none-any.whl

Development Status :: 5 - Production/StableIntended Audience :: DevelopersIntended Audience :: EducationIntended Audience :: Information TechnologyLicense :: OSI Approved :: Apache Software LicenseOperating System :: OS IndependentProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.6Programming Language :: Python :: 3.7Programming Language :: Python :: 3.8Programming Language :: Python :: 3.9Programming Language :: Python :: Implementation :: CPythonProgramming Language :: Python :: Implementation :: PyPyTopic :: Security :: Cryptography

About rsa

from the package's own PyPI description — quoted content, verbatim

Python-RSA has been archived

Hi folks,

I'm Sybren, one of the original authors and the maintainer of this project. Unfortunately I don't have the time and brain space left to properly maintain Python-RSA. As you can see from the lack of activity on the open issues, and the lack of commits, that has been the case for a while now.

As Python-RSA is included as a dependency in quite a few high-profile projects, I don't feel comfortable handing over the project to someone else. It's just too big of a risk.

Thanks for having used this little library for so long, and in so many projects. I truely didn't expect that when I started working on it. Also big thanks to all the people helping out and improving the project.

There are improvements that haven't made it into a new release. As I said, I don't have the time and the brain space to really investigate and oversee the security impact of all those changes. It's not a decision I've made lightly.

So that's it. If you want to keep the project alive, please fork it. Give it the love it deserves, investigate those yet-unreleased improvements, and have a project that's then already better than how I left this...

Read as markdown · JSON record · Source repository · Homepage

AI interpretation — verify before relying

AI-generated interpretation of the package facts above; every digit, version, license, or vulnerability id it cites is grounded in the facts already shown on this page

Pure-Python RSA implementation supporting encryption, decryption, signing, and key generation according to PKCS#1 version 1.5, usable as a library and command-line tool.

Installation is straightforward with low friction—a single pure-Python wheel dependency on pyasn1. However, the project is archived and abandoned; the maintainer explicitly states they lack capacity to oversee security changes, and no releases have shipped in 484 days despite unreleased improvements pending review.

Licensed under Apache-2.0 (permissive), allowing commercial and private use with minimal restrictions, though you assume full responsibility for security maintenance given the project's abandoned status.

Usage

pip install rsa

import rsa
(pubkey, privkey) = rsa.newkeys()
message = b'hello world'
encrypted = rsa.encrypt(message, pubkey)
decrypted = rsa.decrypt(encrypted, privkey)

Python >= 3.6 required; pure-Python implementation is not resistant to timing attacks—use with caution in security-critical contexts.

Verdict: A stable, widely-used pure-Python RSA library suitable for non-critical cryptographic tasks, but now archived with no active maintenance. The maintainer explicitly declined to hand over the project due to security risk, and unreviewed improvements remain unreleased. Consider alternatives if you need active security oversight; use rsa only where the lack of ongoing maintenance is acceptable.

Needs verification

Whether the timing-attack vulnerability mentioned in the description represents a practical risk for your use case
Whether any of the unreleased improvements address known cryptographic weaknesses
Current real-world adoption patterns and whether maintained forks exist

RSA encryption decryption Pythondigital signature verificationkey generation PKCS#1pure Python cryptographyasymmetric encryption library