Best Sports Iptv
Secure Sports Streaming: How Security-Minded Fans in Brazil Watch Live Football with IPTV If you spend your working lif…
Read full story → v4.2 PQC-ready • SOC2 • Open Source
Free Cloud HSM for everyone
Free Cloud HSM — Hardware Security Module for Everyone. Generate, store and use crypto keys inside real hardware — via PKCS#11, KMIP, JCE, OpenSSL engine and REST KMS. No credit card. No vendor lock.
41k+developers
12M+ops / day
99.99%uptime
0 €to start
🔒 FIPS 140-3 Level 3
⚡ 8,400 ops/sec
$ freehsm init --slot free --pqc kyber1024
✓ attested enclave eu-west • key never exportable
$ openssl req -engine freehsm -new -key slot_42
✓ attested enclave eu-west • key never exportable
$ openssl req -engine freehsm -new -key slot_42
PKCS#11 ◆ KMIP 2.1 ◆ POST-QUANTUM ◆ CODE SIGNING ◆ MTLS ◆ KUBERNETES ◆ EJBCA ◆ OPEN SOURCE ◆ PKCS#11 ◆ KMIP 2.1 ◆ POST-QUANTUM ◆ CODE SIGNING ◆ MTLS ◆ KUBERNETES ◆ EJBCA ◆ OPEN SOURCE ◆
01 — About FreeHSM.net
Hardware roots of trust, without the invoice
FreeHSM.net was born in 2019 as a community experiment: what if any indie hacker, student or startup could use a real Hardware Security Module for free? Today we run a federated network of Thales, YubiHSM, Nitrokey and open FPGA HSMs fronted by a modern KMS API. Private keys are generated inside hardware, never leave it, and every operation is attested.
🛡️
Why free?
Sponsored by audits, premium clusters and custody. Community slots stay free forever — 5 keys, 10k ops/day.
We fixed what AWS CloudHSM & Vault got wrong
Cloud HSMs cost $1,500/mo and take days to provision. Software vaults leak keys via RAM. FreeHSM gives you hardware isolation with DX like Stripe: one curl, one SDK, one dashboard.
- ✅ True hardware: FIPS 140-3 L3
- ✅ Remote attestation proof
- ✅ PQC: Kyber, Dilithium, SPHINCS+
- ✅ Open firmware + reproducible builds
- ✅ GDPR / EU + US regions
- ✅ No key escrow, zero-knowledge
2019 — Garage HSM
First YubiHSM2 shared over PKCS#11 proxy for Let's Encrypt community.
2022 — FreeHSM Cloud
REST KMS, Kubernetes CSI driver, Sigstore integration. 10k users.
2025 — PQC & Confidential
Nitro Enclaves + SEV-SNP, post-quantum by default, EU sovereign cloud.
2026 — Federated mesh
Anyone can donate HSM capacity. Audited transparency log for every key ceremony.
# architecture at a glance
app → FreeHSM Edge (mTLS + OAuth OIDC) → Policy Engine (OPA) → HSM Mesh [slot_42, slot_43…]
attest: sigstore / TPM quote / AWS Nitro attestation doc
app → FreeHSM Edge (mTLS + OAuth OIDC) → Policy Engine (OPA) → HSM Mesh [slot_42, slot_43…]
attest: sigstore / TPM quote / AWS Nitro attestation doc
02 — Features
One slot. Every protocol.
Drop-in replacement for expensive HSMs. Keep your OpenSSL, Java, Vault, Smallstep configs — just point to FreeHSM.
Flagship
PKCS#11 + OpenSSL Engine
Sign, decrypt, mTLS without seeing private key. Nginx, Apache, Postfix, Dovecot ready.
KMIP & JCE
VMware, Vault, EJBCA compatible.
Web3 Custody
ETH, BTC threshold ECDSA.
REST KMS + SDKs
Python, Go, Node, Rust in 5 lines.
Code & Container Signing
Sigstore, Cosign, Authenticode.
🔐 Zero-export keys
CKA_EXTRACTABLE=false by default. Wrap with AES-KWP only under quorum.
📜 Transparency log
Every ceremony logged to Rekor-style Merkle tree. Verify independently.
🌍 Sovereign regions
EU (Frankfurt, Paris), US, plus community nodes. Choose residency per key.
03 — How it works
Live in 47 seconds
No sales call. No ticket. Spin a virtual slot backed by real hardware partitioning.
01
Claim slot
OAuth + WebAuthn. Get slot ID + attestation cert.
02
Generate keys
RSA, EC, Ed25519, Kyber inside HSM.
03
Connect app
PKCS#11 lib, REST token or K8s operator.
04
Audit & rotate
Auto-rotation, alerting, dual control.
$ pip install freehsm
from freehsm import Client
hsm = Client(slot="free-42", token=env.FREEHSM_TOKEN)
# generate non-exportable key
key = hsm.generate("EC_P384", label="payments-prod")
print(key.attestation_url)
# sign without seeing private key
sig = key.sign(b"invoice#881")
✓ 2.1ms • HSM: nitro-eu-07 • PQC-hybrid
$ cosign sign --key freehsm://slot_42 ghcr.io/app:v2
$ kubectl apply -f freehsm-csi.yaml
from freehsm import Client
hsm = Client(slot="free-42", token=env.FREEHSM_TOKEN)
# generate non-exportable key
key = hsm.generate("EC_P384", label="payments-prod")
print(key.attestation_url)
# sign without seeing private key
sig = key.sign(b"invoice#881")
✓ 2.1ms • HSM: nitro-eu-07 • PQC-hybrid
$ cosign sign --key freehsm://slot_42 ghcr.io/app:v2
$ kubectl apply -f freehsm-csi.yaml
04 — Use cases
Built for paranoids
TLS & mTLS at scale
Terminate 10k certs with OCSP stapling. Auto-renew via ACME + HSM-bound keys for Kubernetes ingress.
IoT provisioning
Inject unique device certs at factory. EST + SCEP with hardware attestation for ESP32, RPi, autos.
Self-custody & MPC
Threshold signatures for treasuries, exchanges, DAOs. No single point of compromise.
Supply-chain signing
Sign Git commits, containers, SBOMs, Windows drivers. SLSA L3 + Sigstore transparency.
Database & backup encryption
Envelope encryption for Postgres, S3, Backblaze. DEK wrap in HSM, KMS-compatible API.
Passkeys & 2FA
Host your own WebAuthn RP keys in HSM. FIDO2 attestation for banks & schools.
05 — Pricing
Free means free
Community slots are subsidized by premium dedicated partitions. Upgrade only when you need SLAs.
Community
€0
For hackers, students, OSS
- 1 shared HSM slot
- 5 keys, EC/RSA/Ed25519
- 10k ops / day
- PKCS#11 + REST
- Community Discord
⚡ Pro Mesh
€19/mo
For startups & SaaS
- 3 private partitions
- 100 keys + PQC hybrid
- 1M ops / day
- KMIP, K8s operator, ACME
- Attestation + transparency
- 99.99% SLA
Sovereign
€499/mo
Banks, gov, custody
- Dedicated Thales Luna
- Unlimited keys, quorum
- Dual control + on-site ceremony
- EU-only residency
- Audit + eIDAS support
06 — Newsroom
Fresh from the enclave
Research notes, CVE responses, PQC migration guides and mesh status. Click any card to open the full article.
07 — FAQ
Questions? Answers.
4.9/5dev satisfaction
24/7mesh monitoring
Is FreeHSM really free? What's the catch?
No catch. Community slots run on donated + oversubscribed partitions. Limits are 5 keys and 10k ops/day. If you need more, Pro funds the free tier.
Do you see my private keys?
No. Keys are generated inside FIPS hardware with CKA_EXTRACTABLE=false. Our operators only see opaque handles, policy checks and attestation quotes. Even backups are encrypted with quorum shards.
How is this different from HashiCorp Vault?
Vault is great software, but keys live in RAM. FreeHSM keeps them in silicon. You can even put Vault on top of FreeHSM via PKCS#11 for best of both.
Can I migrate from AWS CloudHSM?
Yes — one-command migrator re-wraps keys under dual control, repoints PKCS#11 slot config and replays audit log. Most teams switch in an afternoon.
Is post-quantum supported?
Yes. ML-KEM (Kyber), ML-DSA (Dilithium) and hybrid X25519+Kyber for TLS. Classical + PQC dual signatures for code signing.
Where is my data stored?
You pick: EU (Frankfurt/Paris) or US. Metadata stays in-region. Transparency log is global but contains only hashes, no PII.
08 — Get started
Claim your free HSM slot today
WebAuthn login • Attested in 47s • No credit card • MIT-licensed clients. Join the newsletter for PQC guides and outage transparency.
By signing up you agree to fair-use (10k ops/day) and transparency logging of key ceremonies.
★★★★★
“Migrated our CA from $2k/mo CloudHSM to FreeHSM Pro in 3 hours. Attestation + Sigstore made auditors happy.”
— Lena K., DevSecOps, Fintech★★★★★
“Finally PQC for mortals. Our ESP32 fleet gets Dilithium certs via EST, all backed by real hardware.”
— Marco D., IoT Lead★★★★★
“Free tier signed 40k containers for our OSS project. Transparency log is genius.”
— Aisha R., Maintainer