You can install cryptography with pip:
$ pip install cryptography
If this does not work please upgrade your pip first, as that is thesingle most common cause of installation problems.
Supported platforms
Currently we test cryptography on Python 3.7+ and PyPy3 7.3.11+ on theseoperating systems.
x86-64 RHEL 8.x
x86-64 CentOS 9 Stream
x86-64 Fedora (latest)
x86-64 macOS 13 Ventura and ARM64 macOS 14 Sonoma
x86-64 Ubuntu 20.04, 22.04, rolling
ARM64 Ubuntu 22.04
x86-64 Debian Buster (10.x), Bullseye (11.x), Bookworm (12.x),Trixie (13.x), and Sid (unstable)
x86-64 and ARM64 Alpine (latest)
32-bit and 64-bit Python on 64-bit Windows Server 2022
We test compiling with clang as well as gcc and use the followingOpenSSL releases in addition to distribution provided releases from theabove supported platforms:
OpenSSL 1.1.1-latestOpenSSL 3.0-latestOpenSSL 3.1-latestOpenSSL 3.2-latest
We also test against the latest commit of BoringSSL as well as versions ofLibreSSL that are receiving security support at the time of a givencryptography release.
Building cryptography on Windows
The wheel package on Windows is a statically linked build (as of 0.5) so alldependencies are included. To install cryptography, you will typicallyjust run
$ pip install cryptography
If you prefer to compile it yourself you’ll need to have OpenSSL installed.You can compile OpenSSL yourself as well or use a binary distribution.Be sure to download the proper version for your architecture and Python(VC2015 is required for 3.7 and above). Wherever you place your copy of OpenSSLyou’ll need to set the OPENSSL_DIR environment variable to include theproper location. For example:
C:\> \path\to\vcvarsall.bat x86_amd64C:\> set OPENSSL_DIR=C:\OpenSSL-win64C:\> pip install cryptography
You will also need to have Rust installed andavailable.
If you need to rebuild cryptography for any reason be sure to clear thelocal wheel cache.
Building cryptography on Linux
Note
You should upgrade pip and attempt to install cryptography againbefore following the instructions to compile it below. Most Linuxplatforms will receive a binary wheel and require no compiler if you havean updated pip!
cryptography ships manylinux wheels (as of 2.0) so all dependenciesare included. For users on pip 19.3 or above running on a manylinux2014(or greater) compatible distribution (or pip 21.2.4 for musllinux) allyou should need to do is:
$ pip install cryptography
If you want to compile cryptography yourself you’ll need a C compiler, aRust compiler, headers for Python (if you’re not using pypy), and headersfor the OpenSSL and libffi libraries available on your system.
On all Linux distributions you will need to have Rust installed andavailable.
Alpine
Warning
The Rust available by default in Alpine < 3.17 is older than the minimumsupported version. See the Rust installation instructions for information about installing a newer Rust.
$ sudo apk add gcc musl-dev python3-dev libffi-dev openssl-dev cargo pkgconfig
If you get an error with openssl-dev you may have to use libressl-dev.
Debian/Ubuntu
Warning
The Rust available in Debian versions prior to Bookworm are older than theminimum supported version. See the Rust installation instructions for information about installing a newer Rust.
$ sudo apt-get install build-essential libssl-dev libffi-dev \ python3-dev cargo pkg-config
Fedora/RHEL/CentOS
Warning
For RHEL and CentOS you must be on version 8.8 or newer for the commandbelow to install a sufficiently new Rust. If your Rust is less than 1.65.0please see the Rust installation instructionsfor information about installing a newer Rust.
$ sudo dnf install redhat-rpm-config gcc libffi-devel python3-devel \ openssl-devel cargo pkg-config
Building
You should now be able to build and install cryptography. To avoid gettingthe pre-built wheel on manylinux compatible distributions you’ll need touse --no-binary.
$ pip install cryptography --no-binary cryptography
Using your own OpenSSL on Linux
Python links to OpenSSL for its own purposes and this can sometimes causeproblems when you wish to use a different version of OpenSSL with cryptography.If you want to use cryptography with your own build of OpenSSL you will need tomake sure that the build is configured correctly so that your version ofOpenSSL doesn’t conflict with Python’s.
The options you need to add allow the linker to identify every symbol correctlyeven when multiple versions of the library are linked into the same program. Ifyou are using your distribution’s source packages these will probably bepatched in for you already, otherwise you’ll need to use options something likethis when configuring OpenSSL:
$ ./config -Wl,-Bsymbolic-functions -fPIC shared
Static Wheels
Cryptography ships statically-linked wheels for macOS, Windows, and Linux (viamanylinux and musllinux). This allows compatible environments to usethe most recent OpenSSL, regardless of what is shipped by default on thoseplatforms.
If you are using a platform not covered by our wheels, you can build your ownstatically-linked wheels that will work on your own systems. This will allowyou to continue to use relatively old Linux distributions (such as LTSreleases), while making sure you have the most recent OpenSSL available toyour Python programs.
To do so, you should find yourself a machine that is as similar as possible toyour target environment (e.g. your production environment): for example, spinup a new cloud server running your target Linux distribution. On this machine,install the Cryptography dependencies as mentioned in Building cryptography on Linux.Please also make sure you have virtualenv installed: this should beavailable from your system package manager.
Then, paste the following into a shell script. You’ll need to populate theOPENSSL_VERSION variable. To do that, visit openssl.org and find thelatest non-FIPS release version number, then set the string appropriately. Forexample, for OpenSSL 1.1.1k, use OPENSSL_VERSION="1.1.1k".
When this shell script is complete, you’ll find a collection of wheel files ina directory called wheelhouse. These wheels can be installed by asufficiently-recent version of pip. The Cryptography wheel in thisdirectory contains a statically-linked OpenSSL binding, which ensures that youhave access to the most-recent OpenSSL releases without corrupting your systemdependencies.
set -eOPENSSL_VERSION="VERSIONGOESHERE"CWD=$(pwd)virtualenv env. env/bin/activatepip install -U setuptoolspip install -U wheel pipcurl -O https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gztar xvf openssl-${OPENSSL_VERSION}.tar.gzcd openssl-${OPENSSL_VERSION}./config no-shared no-ssl2 no-ssl3 -fPIC --prefix=${CWD}/opensslmake && make installcd ..OPENSSL_DIR="${CWD}/openssl" pip wheel --no-cache-dir --no-binary cryptography cryptography
Building cryptography on macOS
Note
If installation gives a fatal error: 'openssl/aes.h' file not foundsee the FAQ for information about how to fix this issue.
The wheel package on macOS is a statically linked build (as of 1.0.1) so forusers with pip 8 or above you only need one step:
$ pip install cryptography
If you want to build cryptography yourself or are on an older macOS version,cryptography requires the presence of a C compiler, development headers, andthe proper libraries. On macOS much of this is provided by Apple’s Xcodedevelopment tools. To install the Xcode command line tools (on macOS 10.10+)open a terminal window and run:
$ xcode-select --install
This will install a compiler (clang) along with (most of) the requireddevelopment headers.
You will also need to have Rust installed andavailable, which can be obtained from Homebrew,MacPorts, or directly from the Rust website. If you are linking against auniversal2 archive of OpenSSL, the minimum supported Rust version is1.66.0.
Finally you need OpenSSL, which you can obtain from Homebrew or MacPorts.Cryptography does not support the OpenSSL/LibreSSL libraries Apple shipsin its base operating system.
To build cryptography and dynamically link it:
$ brew install openssl@3 rust$ env OPENSSL_DIR="$(brew --prefix openssl@3)" pip install cryptography
$ sudo port install openssl rust$ env OPENSSL_DIR="-L/opt/local" pip install cryptography
You can also build cryptography statically:
$ brew install openssl@3 rust$ env OPENSSL_STATIC=1 OPENSSL_DIR="$(brew --prefix openssl@3)" pip install cryptography
$ sudo port install openssl rust$ env OPENSSL_STATIC=1 OPENSSL_DIR="/opt/local" pip install cryptography
If you need to rebuild cryptography for any reason be sure to clear thelocal wheel cache.
Rust
Note
If you are using Linux, then you should upgrade pip (ina virtual environment!) and attempt to install cryptography again beforetrying to install the Rust toolchain. On most Linux distributions, the latestversion of pip will be able to install a binary wheel, so you won’t needa Rust toolchain.
Building cryptography requires having a working Rust toolchain. The currentminimum supported Rust version is 1.65.0. This is newer than the Rust somepackage managers ship, so users may need to install with theinstructions below.
Instructions for installing Rust can be found on the Rust Project’s website.We recommend installing Rust with rustup (as documented by the RustProject) in order to ensure you have a recent version.
Rust is only required when building cryptography, meaning that you mayinstall it for the duration of your pip install command and then remove itfrom a system. A Rust toolchain is not required to use cryptography. Indeployments such as docker, you may use a multi-stage Dockerfile whereyou install Rust during the build phase but do not install it in the runtimeimage. This is the same as the C compiler toolchain which is also required tobuild cryptography, but not afterwards.
