tink

What it is and what it does

Tink is Google's cryptography library designed to make secure crypto accessible without requiring deep cryptographic expertise. It provides high-level APIs for authenticated encryption, key management, and digital signatures that are resistant to common implementation mistakes. The library is built on lessons learned from Google's own product deployments and security research, emphasizing user-centered design and careful code review.

The Python binding wraps Tink's core functionality and is maintained actively with support for modern Python versions (3.10–3.14). It depends on protobuf, absl-py, and bazel-runfiles. Installation uses precompiled wheels for most platforms, reducing build friction. Tink is positioned as a standard crypto library within Google and has been deployed across hundreds of products, making it a production-grade choice for applications requiring strong cryptographic guarantees without the complexity of lower-level APIs.

Use it for:

• Encrypting sensitive data at rest or in transit using authenticated encryption primitives without managing cipher modes manually.
• Implementing key rotation and key management policies through Tink's keyset abstraction and key versioning.
• Adding digital signatures to messages or documents for integrity and authenticity verification.
• Building applications that require compliance with cryptographic best practices without deep security expertise.
• Integrating with key management systems for envelope encryption and centralized key management.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Tink provides cryptographic APIs designed to be secure by default and difficult to misuse, offering authenticated encryption, key management, and digital signatures across multiple platforms.

Yes. Tink is actively maintained, has no known vulnerabilities, supports current Python versions, and carries a permissive license. It is appropriate for any application requiring cryptography where ease of correct use and resistance to common pitfalls outweigh the need for lower-level control. The medium install friction is offset by prebuilt wheels and straightforward dependencies.

Install

tink on PyPI

pip install tink

uv add tink

poetry add tink

Installing tink

Before you install

Medium install friction due to compiled wheels, but well-maintained with active development (release 1 day old as of fact sheet date). Supports Python 3.10 through 3.14 with prebuilt wheels for macOS, Linux (x86_64 and aarch64), and Windows.

License in practice

Apache 2.0 permissive license allows commercial use, modification, and distribution with minimal restrictions—suitable for most projects without legal friction.

Quickstart

pip install tink

import tink
from tink import aead

# Initialize Tink
tink.Tink.init()

# Generate a new keyset for AEAD
keyset_handle = aead.new_keyset_handle(aead.aead_key_templates.AES_GCM)
cipher = keyset_handle.primitive(aead.Aead)

Requires Python 3.10 or later; depends on protobuf, absl-py, and bazel-runfiles at runtime.

Verify before relying

• Whether KMS integration (mentioned in test matrix) is available in the pip-installed version or requires additional setup.
• Performance characteristics compared to other cryptography libraries for specific use cases.
• Availability and completeness of documentation beyond the Google Tink design goals page.
• Specific AEAD key template names and their availability in the Python binding.

Package facts

Evidence: tink-1.16.1-cp310-cp310-macosx_11_0_universal2.whl; tink-1.16.1-cp310-cp310-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl; tink-1.16.1-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl; tink-1.16.1-cp310-cp310-win_amd64.whl; tink-1.16.1-cp311-cp311-macosx_11_0_universal2.whl; tink-1.16.1-cp311-cp311-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl; tink-1.16.1-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl; tink-1.16.1-cp311-cp311-win_amd64.whl; tink-1.16.1-cp312-cp312-macosx_11_0_universal2.whl; tink-1.16.1-cp312-cp312-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl; tink-1.16.1-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl; tink-1.16.1-cp312-cp312-win_amd64.whl; tink-1.16.1-cp313-cp313-macosx_11_0_universal2.whl; tink-1.16.1-cp313-cp313-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl; tink-1.16.1-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl; tink-1.16.1-cp313-cp313-win_amd64.whl; tink-1.16.1-cp314-cp314-macosx_11_0_universal2.whl; tink-1.16.1-cp314-cp314-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl; tink-1.16.1-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl; tink-1.16.1-cp314-cp314-win_amd64.whl

Keywords: tink, cryptography

Tags

More Libraries packages