Security keys & HSMs

Nitrokey HSM 2

Hardware security module for PKI, code signing, CA operations, and SSH host key storage. Open-source firmware, USB-A interface. The affordable HSM for teams that need hardware-bound keys but can't justify an enterprise rack appliance.

Nitrokey Pro 2

OpenPGP smart-card key with a tamper-resistant smart card, one-time passwords, and a 16-entry password manager. For email/file encryption, SSH, and X.509 — OpenPGP Card 3.4, no FIDO2.

Nitrokey 3A NFC Hacker

NOT A READY-TO-USE SECURITY KEY. This is the bare Nitrokey 3A NFC electronics shipped WITHOUT firmware, in an unprinted case, for developers building their own firmware on the LPC55S69. If you want a working key, buy the Nitrokey 3A NFC instead.

Nitrokey 3A (No NFC)

USB-A hardware token built on an SE050 secure element certified to Common Criteria EAL 6+, with Rust-based open-source firmware. Consolidates FIDO2, OTP, and OpenPGP/PIV in one tamper-resistant device.

Nitrokey 3C (No NFC)

USB-C hardware security key built on an EAL 6+ certified SE050 secure element and Rust firmware. Delivers FIDO2, U2F, OpenPGP and OTP for phishing-resistant authentication and key protection.

Nitrokey 3C NFC

EAL 6+ certified secure element, open-source firmware. FIDO2/WebAuthn, OpenPGP, OTP, PIV smart card. USB-C + NFC. The open-source alternative to YubiKey.

Nitrokey 3A NFC

USB-A variant of the Nitrokey 3 with NFC. Same EAL 6+ secure element and open-source firmware as the 3C. For legacy hardware without USB-C or as a backup key.

Nitrokey 3A Mini

Compact USB-A hardware security key with an NXP SE050 EAL 6+ secure element and Rust open-source firmware, delivering phishing-resistant FIDO2/WebAuthn MFA plus OpenPGP, OTP, and X.509 key storage.

Nitrokey Start

The entry-level Nitrokey: an OpenPGP smart-card key for encrypting email, files, and SSH/server access. Open-source hardware (OSHwA certified), made in Germany. OpenPGP only — no FIDO2, no NFC.

Nitrokey Passkey

FIDO2/WebAuthn and U2F hardware key for phishing-resistant passwordless login and 2FA. Rust-based open-source firmware on an nRF52 secure element, made in Germany, priced for fleet-wide rollout.