Free Cloud HSM for everyone
Free Cloud HSM — Hardware Security Module for Everyone. Generate, store and use crypto keys inside real hardware — via PKCS#11, KMIP, JCE, OpenSSL engine and REST KMS. No credit card. No vendor lock.
✓ attested enclave eu-west • key never exportable
$ openssl req -engine freehsm -new -key slot_42
Hardware roots of trust, without the invoice
FreeHSM.net was born in 2019 as a community experiment: what if any indie hacker, student or startup could use a real Hardware Security Module for free? Today we run a federated network of Thales, YubiHSM, Nitrokey and open FPGA HSMs fronted by a modern KMS API. Private keys are generated inside hardware, never leave it, and every operation is attested.
Sponsored by audits, premium clusters and custody. Community slots stay free forever — 5 keys, 10k ops/day.
We fixed what AWS CloudHSM & Vault got wrong
Cloud HSMs cost $1,500/mo and take days to provision. Software vaults leak keys via RAM. FreeHSM gives you hardware isolation with DX like Stripe: one curl, one SDK, one dashboard.
- ✅ True hardware: FIPS 140-3 L3
- ✅ Remote attestation proof
- ✅ PQC: Kyber, Dilithium, SPHINCS+
- ✅ Open firmware + reproducible builds
- ✅ GDPR / EU + US regions
- ✅ No key escrow, zero-knowledge
First YubiHSM2 shared over PKCS#11 proxy for Let's Encrypt community.
REST KMS, Kubernetes CSI driver, Sigstore integration. 10k users.
Nitro Enclaves + SEV-SNP, post-quantum by default, EU sovereign cloud.
Anyone can donate HSM capacity. Audited transparency log for every key ceremony.
app → FreeHSM Edge (mTLS + OAuth OIDC) → Policy Engine (OPA) → HSM Mesh [slot_42, slot_43…]
attest: sigstore / TPM quote / AWS Nitro attestation doc
One slot. Every protocol.
Drop-in replacement for expensive HSMs. Keep your OpenSSL, Java, Vault, Smallstep configs — just point to FreeHSM.
PKCS#11 + OpenSSL Engine
Sign, decrypt, mTLS without seeing private key. Nginx, Apache, Postfix, Dovecot ready.
KMIP & JCE
VMware, Vault, EJBCA compatible.
Web3 Custody
ETH, BTC threshold ECDSA.
REST KMS + SDKs
Python, Go, Node, Rust in 5 lines.
Code & Container Signing
Sigstore, Cosign, Authenticode.
🔐 Zero-export keys
CKA_EXTRACTABLE=false by default. Wrap with AES-KWP only under quorum.
📜 Transparency log
Every ceremony logged to Rekor-style Merkle tree. Verify independently.
🌍 Sovereign regions
EU (Frankfurt, Paris), US, plus community nodes. Choose residency per key.
Live in 47 seconds
No sales call. No ticket. Spin a virtual slot backed by real hardware partitioning.
Claim slot
OAuth + WebAuthn. Get slot ID + attestation cert.
Generate keys
RSA, EC, Ed25519, Kyber inside HSM.
Connect app
PKCS#11 lib, REST token or K8s operator.
Audit & rotate
Auto-rotation, alerting, dual control.
from freehsm import Client
hsm = Client(slot="free-42", token=env.FREEHSM_TOKEN)
# generate non-exportable key
key = hsm.generate("EC_P384", label="payments-prod")
print(key.attestation_url)
# sign without seeing private key
sig = key.sign(b"invoice#881")
✓ 2.1ms • HSM: nitro-eu-07 • PQC-hybrid
$ cosign sign --key freehsm://slot_42 ghcr.io/app:v2
$ kubectl apply -f freehsm-csi.yaml
Built for paranoids
TLS & mTLS at scale
Terminate 10k certs with OCSP stapling. Auto-renew via ACME + HSM-bound keys for Kubernetes ingress.
IoT provisioning
Inject unique device certs at factory. EST + SCEP with hardware attestation for ESP32, RPi, autos.
Self-custody & MPC
Threshold signatures for treasuries, exchanges, DAOs. No single point of compromise.
Supply-chain signing
Sign Git commits, containers, SBOMs, Windows drivers. SLSA L3 + Sigstore transparency.
Database & backup encryption
Envelope encryption for Postgres, S3, Backblaze. DEK wrap in HSM, KMS-compatible API.
Passkeys & 2FA
Host your own WebAuthn RP keys in HSM. FIDO2 attestation for banks & schools.
Free means free
Community slots are subsidized by premium dedicated partitions. Upgrade only when you need SLAs.
Community
For hackers, students, OSS
- 1 shared HSM slot
- 5 keys, EC/RSA/Ed25519
- 10k ops / day
- PKCS#11 + REST
- Community Discord
⚡ Pro Mesh
For startups & SaaS
- 3 private partitions
- 100 keys + PQC hybrid
- 1M ops / day
- KMIP, K8s operator, ACME
- Attestation + transparency
- 99.99% SLA
Sovereign
Banks, gov, custody
- Dedicated Thales Luna
- Unlimited keys, quorum
- Dual control + on-site ceremony
- EU-only residency
- Audit + eIDAS support
Fresh from the enclave
Research notes, CVE responses, PQC migration guides and mesh status. Click any card to open the full article.
Kyber1024 now default for all free slots
Post-quantum hybrid handshake is live. No action needed — attestation shows new OID.
2026 audit: zero criticals
Independent Cure-style review of firmware, edge and transparency log. Report inside.
Mesh hits 99.995% in Q2
How we survived two datacenter failovers without losing a single signing op.
Questions? Answers.
Is FreeHSM really free? What's the catch?
No catch. Community slots run on donated + oversubscribed partitions. Limits are 5 keys and 10k ops/day. If you need more, Pro funds the free tier.
Do you see my private keys?
No. Keys are generated inside FIPS hardware with CKA_EXTRACTABLE=false. Our operators only see opaque handles, policy checks and attestation quotes. Even backups are encrypted with quorum shards.
How is this different from HashiCorp Vault?
Vault is great software, but keys live in RAM. FreeHSM keeps them in silicon. You can even put Vault on top of FreeHSM via PKCS#11 for best of both.
Can I migrate from AWS CloudHSM?
Yes — one-command migrator re-wraps keys under dual control, repoints PKCS#11 slot config and replays audit log. Most teams switch in an afternoon.
Is post-quantum supported?
Yes. ML-KEM (Kyber), ML-DSA (Dilithium) and hybrid X25519+Kyber for TLS. Classical + PQC dual signatures for code signing.
Where is my data stored?
You pick: EU (Frankfurt/Paris) or US. Metadata stays in-region. Transparency log is global but contains only hashes, no PII.
Claim your free HSM slot today
WebAuthn login • Attested in 47s • No credit card • MIT-licensed clients. Join the newsletter for PQC guides and outage transparency.
By signing up you agree to fair-use (10k ops/day) and transparency logging of key ceremonies.
“Migrated our CA from $2k/mo CloudHSM to FreeHSM Pro in 3 hours. Attestation + Sigstore made auditors happy.”
— Lena K., DevSecOps, Fintech“Finally PQC for mortals. Our ESP32 fleet gets Dilithium certs via EST, all backed by real hardware.”
— Marco D., IoT Lead“Free tier signed 40k containers for our OSS project. Transparency log is genius.”
— Aisha R., Maintainer