OSI-licensed open source
A virtual or software HSM exposes the same PKCS#11 interface as a hardware security module but keeps keys in software. Developers use them to test code that will later run against real hardware, and sometimes for low-assurance production keys. They do not give you the tamper resistance of an actual HSM.
True open-source virtual HSMs are few, so this page is broadened to software PKCS#11 tokens, emulators and the glue that connects applications to them, plus OpenBao for service-based key operations. Everything here is open source with licences read from its repository on 2026-11-07.
Tools, licences and pricing checked against vendor and repository pages on November 7, 2026.
| Tool | Best for | Pricing | Licence |
|---|---|---|---|
| SoftHSM2 | Testing and development against a PKCS#11 interface | Free, open source | BSD-2-Clause |
| Kryoptic | Modern Rust-based software token | Free, open source | Apache-2.0 |
| openCryptoki | Linux and AIX PKCS#11 deployments | Free, open source | CPL-1.0 |
| swtpm | Virtual TPMs for VMs and tests | Free, open source | BSD-3-Clause |
| OpenSC | Connecting applications to smart cards and tokens | Free, open source | LGPL-2.1 |
| pkcs11-provider | Using SoftHSM or hardware tokens from OpenSSL 3 | Free, open source | Apache-2.0 |
| OpenBao | Service-based key operations | Free, open source | MPL-2.0 |
Best for: Testing and development against a PKCS#11 interface · Free, open source
SoftHSM is a software PKCS#11 cryptographic device that lets applications such as OpenDNSSEC manage keys without dedicated hardware.
Best for: Modern Rust-based software token · Free, open source
Kryoptic is a software-based PKCS#11 cryptographic token implemented in Rust.
Best for: Linux and AIX PKCS#11 deployments · Free, open source
openCryptoki is a PKCS#11 library and toolset for Linux and AIX with tokens for IBM crypto hardware and a software token.
Best for: Virtual TPMs for VMs and tests · Free, open source
swtpm is a libtpms-based TPM emulator with socket, character device and Linux CUSE interfaces, useful for virtualised TPM testing.
Best for: Connecting applications to smart cards and tokens · Free, open source
OpenSC provides tools and middleware for smart cards, supporting PKCS#11 and MiniDriver interfaces.
Best for: Using SoftHSM or hardware tokens from OpenSSL 3 · Free, open source
A PKCS#11 provider for OpenSSL 3.0 and later, letting OpenSSL use PKCS#11 hardware and software tokens.
Best for: Service-based key operations · Free, open source
OpenBao manages, stores and distributes secrets, certificates and keys as a service, an option when you want key operations over an API rather than PKCS#11.
One email a week with the tools, launches and releases added to TechLogHub. Unsubscribe in one click.
One email a week: new and trending developer tools, fresh comparisons, and what shipped. Unsubscribe in one click.
| If you need… | Start with |
|---|---|
| PKCS#11 testing without hardware | SoftHSM2 |
| Rust-based software token | Kryoptic |
| Linux and AIX PKCS#11 stack | openCryptoki |
| Virtual TPM for VMs | swtpm |
| OpenSSL 3 integration with tokens | pkcs11-provider |
| Smart-card middleware | OpenSC |
| Key operations over an API | OpenBao |
Quick answers to common questions
Software that mimics an HSM's interface, usually PKCS#11, while storing keys in software.
It is mainly for testing. Keys are protected by software, not tamper-resistant hardware.
A software HSM provides PKCS#11 key operations; swtpm emulates a TPM chip for VMs.
Not as a single project; teams combine a software token such as SoftHSM2 with OpenSSL integration and a key service.
List it on TechLogHub and we'll review it for this guide.
