There's plenty of perfectly good encryption libraries for Python; however, Python may not be the best choice as a "secure" programming language.
pynaci and cryptography are pretty good libraries stay way from pycrypto or pycryptodome
If a person was writing something requiring encryption such as a market (to learn, not to really operate it any time soon), then:
Do you think certain parts such as the encryption could be written in Rust to be more secure than pure Python? I'm interested in your opinion as I believe you are more knowledgeable than me about this.
Or would you rather write the whole web app in Rust? Or C? I'm assuming compiled languages are more secure than Python, as well as being faster, but I might be wrong there.
Do you think certain parts such as the encryption could be written in Rust to be more secure than pure Python? I'm interested in your opinion as I believe you are more knowledgeable than me about this.
Or would you rather write the whole web app in Rust? Or C? I'm assuming compiled languages are more secure than Python, as well as being faster, but I might be wrong there.
Don’t roll your own crypto , that’s where people mess up. Just use the cryptography library, it’s solid and widely used. For most cases, Fernet is enough since it handles encryption + authentication safely.
If you need more control, go with AES-GCM or ChaCha20-Poly1305 and avoid outdated stuff like ECB.
Biggest thing: key management. If your key is hardcoded or stored with the data, the encryption is basically useless. Keep it separate.
Stick to standard libs and you’ll be fine.
If you need more control, go with AES-GCM or ChaCha20-Poly1305 and avoid outdated stuff like ECB.
Biggest thing: key management. If your key is hardcoded or stored with the data, the encryption is basically useless. Keep it separate.
Stick to standard libs and you’ll be fine.
As you guessed it's more about the general development environment than about Python libraries especially. I'm sure one can write perfectly safe Python code - which I have limited experience with, to be honest - and I would expect encryption components to be especially focused on safety. The problem is more about how you will integrate these tools for your own software. Working with Rust, C, or even PHP will help to reduce the surface of attack by being more strict, especially in regard to memory management. But I'm making rhetorical point, most DN markets are built with PHP and don't get down because of technical vulnerabilities either :)
Use Fernet.
Ransomware gangs in the past have used this and it's pretty easy to use.
Ransomware gangs in the past have used this and it's pretty easy to use.
Compiled languages like C and C++ are generally less secure than interpreted languages than Python or PHP, but they are faster - the exception to this is obviously Rust
So as far as (memory) safety goes, it really doesn't matter if you use Rust, Python or PHP
So as far as (memory) safety goes, it really doesn't matter if you use Rust, Python or PHP
Python may not be the best choice as a "secure" programming language.
Why not? I dislike Python for its ugly syntax and awful performance, but there's nothing that makes it intrinsically insecure
I agree there isn't anything intrinsically less secure with Python. However, I'd think using it to produce safe code is harder that it would be using more "restrictive" languages.
You mentioned memory safety in another comment; while I don't know Python very well, I do have prior experience with both PHP and Rust, and I would most definitively argue the later to be way less prone to memory exploits than the former. It's not about "Rust being safer than PHP", as it is not about "Rust being safer than Python", but you simply can't allocate memory implicitly with Rust, while you do it all the time with the other two. In 2025, it was estimated that a mere 70% of attacks were linked to memory exploits, which is why exercising tighter control over each allocation means better safety. Surely you can achieve the same with other languages - but Rust constraints you to.
Another issue I can think of is supply-chains attacks in relation to the overall scope of the language. PHP is thought for web from day one, and so is the ecosystem around it. Rust has a much more broader scope, but addresses compartmentalization through packages of the smallest size possible (which tends to build dependency nightmares but that's another story). Python, in the other hand, has grown as the go-to coding language for people who do not code in the first place - researchers, analysts, hobbyists, etc. It's not a bad thing obviously, but I'd expect the gems (?) package offer to be larger and therefore, more exposed to risk as it could be in other languages.
Anyway once again, it's merely my opinion. What really matters in the end is the engineer putting the work. One can certainly write a totally unsafe Rust program while achieving perfect isolation and safety with Python :)
You mentioned memory safety in another comment; while I don't know Python very well, I do have prior experience with both PHP and Rust, and I would most definitively argue the later to be way less prone to memory exploits than the former. It's not about "Rust being safer than PHP", as it is not about "Rust being safer than Python", but you simply can't allocate memory implicitly with Rust, while you do it all the time with the other two. In 2025, it was estimated that a mere 70% of attacks were linked to memory exploits, which is why exercising tighter control over each allocation means better safety. Surely you can achieve the same with other languages - but Rust constraints you to.
Another issue I can think of is supply-chains attacks in relation to the overall scope of the language. PHP is thought for web from day one, and so is the ecosystem around it. Rust has a much more broader scope, but addresses compartmentalization through packages of the smallest size possible (which tends to build dependency nightmares but that's another story). Python, in the other hand, has grown as the go-to coding language for people who do not code in the first place - researchers, analysts, hobbyists, etc. It's not a bad thing obviously, but I'd expect the gems (?) package offer to be larger and therefore, more exposed to risk as it could be in other languages.
Anyway once again, it's merely my opinion. What really matters in the end is the engineer putting the work. One can certainly write a totally unsafe Rust program while achieving perfect isolation and safety with Python :)
Welcome brother! Since you are self-taught like many of us here, the best advice is: Never roll your own crypto.
Python's built-in libraries like base64 are NOT for security. For real encryption, you should use the cryptography library. It’s the industry standard.
Here is a simple script using Fernet (which uses AES-128 in CBC mode with HMAC):
Python
from cryptography.fernet import Fernet
key = Fernet.generate_key()
f = Fernet(key)
# Encrypting
token = f.encrypt(b"Your Secret Data Here")
print(f"Encrypted: {token}")
decrypted_data = f.decrypt(token)
print(f"Decrypted: {decrypted_data.decode()}")
....... Always keep your key offline. If you lose it, your data is gone forever. Good luck with your projects!
Python's built-in libraries like base64 are NOT for security. For real encryption, you should use the cryptography library. It’s the industry standard.
Here is a simple script using Fernet (which uses AES-128 in CBC mode with HMAC):
Python
from cryptography.fernet import Fernet
key = Fernet.generate_key()
f = Fernet(key)
# Encrypting
token = f.encrypt(b"Your Secret Data Here")
print(f"Encrypted: {token}")
decrypted_data = f.decrypt(token)
print(f"Decrypted: {decrypted_data.decode()}")
....... Always keep your key offline. If you lose it, your data is gone forever. Good luck with your projects!
Members-only continuation
This discussion contains more posts.
Create an account or sign in to continue reading the full conversation. 1 additional post awaits inside.