PyHSM✓ Verified · pyhsm.vectorguardlabs.com

Most teams that need cryptographic key management face a bad tradeoff: implement it yourself and risk getting it wrong, pay for cloud KMS and accept vendor lock-in, or buy a hardware HSM for $20K+ and deal with the complexity. PyHSM is a third option, a production-grade software KMS you own, deploy anywhere, and extend freely. PyHSM handles the full key lifecycle: generation, rotation, encryption, digital signing, and destruction with tamper-evident audit logging on every operation. Keys are double-encrypted at rest (AES-KWP per-key wrapping inside an AES-256-GCM envelope), and raw key material never leaves the HSM boundary. It supports AES-256, RSA, ECDSA (P-256/P-384/P-521/secp256k1), and Ed25519, covering everything from standard application encryption to Ethereum and Solana transaction signing. What makes it different: PyHSM is not a wrapper around a cloud API. It runs entirely in your infrastructure; no network calls to a third party, no data sovereignty concerns, no per-operation billing. You get hardware-HSM-grade security practices (Argon2id key derivation, HKDF key separation, memory zeroization, known-answer self-tests) implemented in software you can audit and modify. Available as a Python CLI/library and a TypeScript/Node.js library, both with pluggable storage backends, per-key access policies, rate limiting, Prometheus metrics, and JSON-structured logging for SIEM integration. Process isolation mode keeps key material in a separate address space from your application. Shamir secret sharing lets you split the master password across multiple custodians. PyHSM is MIT-licensed, has 214 tests across both layers, and is built for teams that want real cryptographic infrastructure without the cloud dependency or hardware cost.