Nitrokey is a German maker of open source security hardware. Its USB security keys and hardware security modules (HSMs) keep keys and credentials on dedicated devices, so individuals, companies and public bodies can log in without passwords, encrypt email and protect server and certificate authority keys, using hardware whose design anyone can inspect.
The problem it addresses is trust in the device itself. A key stored on hardware is only as safe as that hardware, and Nitrokey’s answer is to let customers and independent reviewers check what they are relying on.
At A Glance
| Vendor | Nitrokey (Nitrokey GmbH) |
|---|---|
| Category | Open source security keys and hardware security modules |
| Identities covered | Human users (FIDO2, passkeys, OTP, smart card logon), cryptographic keys and certificates (HSM, PKI, CA) |
| Deployment | USB and NFC hardware tokens; NetHSM as 2U rack hardware or a container image |
| Customers | Bosch, Cisco, Siemens, SAP, Volkswagen |
| Market classification | Workforce IAM |
What Nitrokey Does
Security hardware is only as trustworthy as the code inside it, and most vendors keep that code closed. Nitrokey takes the opposite route and publishes its software and hardware designs, so that users and independent third parties can audit the security of its products. All Nitrokeys are produced in Germany.
The same approach runs from a key on a keyring to a rack in a data centre: secrets stay on a dedicated device, and the device’s code is open. Beyond keys and HSMs, Nitrokey also sells hardened phones, tablets, laptops, PCs and a firewall (NitroPhone, NitroTablet, NitroPad, NitroPC and NitroWall), plus consulting.
Products
Nitrokey 3
Nitrokey 3 is the main security key, available with USB-A, USB-C and NFC, for people who want one device for passkeys, smart card logon and email encryption. It holds 24 PIV key pairs and 3 OpenPGP key pairs, with RSA 2048 to 4096 and ECC 256 to 521. Its OpenPGP smart card also supports the secp256k1 curve.
For users who mainly need passkey and FIDO2 login, Nitrokey Passkey succeeds the Nitrokey FIDO2 and is built on the same technology as the Nitrokey 3.
Nitrokey Pro 2, Start And Storage 2
These earlier models cover narrower needs. Nitrokey Pro 2 holds 3 key pairs with RSA 2048 to 4096 and ECC 256 to 521, Nitrokey Start supports RSA 2048 and ECC 256, and Nitrokey Storage 2 adds encrypted mass storage with hidden volumes.
Nitrokey HSM 2
Nitrokey HSM 2 is a USB hardware security module for teams running their own PKI or certificate authority. It stores 55 key pairs, with RSA 1024 to 4096 and ECC 192 to 521.
NetHSM
NetHSM is an open source, network-attached module that holds keys for servers and performs operations for TLS, DNSSEC, PKI, CA and blockchain use cases. It handles AES, ECC (NIST curves, Curve25519, secp256k1, Brainpool) and RSA 1024 to 8192 keys, with capacity for over one million keys.
It has a physical random number generator certified to AIS 20/31 PTG.3 and a TPM 2.0 secure element.
How It Works
- Security keys. Nitrokeys connect over USB or NFC and keep keys on the device. Some models use a smart card certified to Common Criteria EAL 6+.
- Software. Nitrokey App 2, the nitropy command-line tool and the Nitrokey Python SDK manage devices.
- NetHSM deployment. NetHSM runs as dedicated 2U rack hardware or as a container image on Docker Hub, and devices can be clustered.
- NetHSM interfaces. Applications use a REST API, the pynitrokey command-line tool, a PKCS#11 module or client SDKs.
- NetHSM design. The software is written in OCaml and runs as a MirageOS unikernel, with a formally verified Muen microkernel separating the network driver from key handling. Keys are stored encrypted.
Identities And Systems Covered
| Human users | FIDO2, U2F and passkeys, OTP, passwordless Microsoft login and client logon with Active Directory, plus Nitrokey Provisioning for Entra ID |
|---|---|
| Email identities | OpenPGP and S/MIME keys |
| Certificates and CAs | PKI and CA key storage, including Windows ADCS with PKI Proxy and EJBCA |
| Server keys | TLS keys for web servers and DNSSEC signing keys |
| Secrets management | Keys protecting Hashicorp Vault and OpenBao |
Integrations
| Area | Integrations |
|---|---|
| Login and applications | Windows login, Nextcloud, Odoo |
| Thunderbird, Outlook, Evolution, Claws Mail, GnuPG, GPGTools | |
| Cryptography tools | OpenSSL |
| Network and servers | SSH, PuTTY, OpenVPN, IPSec, stunnel, Apache 2, Nginx |
| DNS | Knot DNS, OpenDNSSEC, Cascade |
| Disk and passwords | LUKS, VeraCrypt, KeePassXC |
Company Background
| Founded | 2015, growing out of the Crypto Stick open source project |
|---|---|
| Headquarters | Teltow, near Berlin, Germany |
| Leadership | Jan Suhr (founder and CEO) |
| Employees | Up to 20 |
| Funding | Self-financed and independent of external investors |
Note: This overview is compiled from Nitrokey’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.