Cryptography in Python

The cryptography package is the standard choice. It has two layers: high-level recipes such as Fernet for symmetric encryption that are hard to misuse, and a hazmat layer of low-level primitives for when you need a specific algorithm or protocol. PyNaCl binds libsodium and offers an opinionated, small API for authenticated encryption, public-key boxes and signatures, which reduces the number of choices you can get wrong.

Paramiko implements SSHv2 in Python for both clients and servers, and tools like Fabric build on it to run commands and transfer files over SSH. itsdangerous signs data such as cookies, tokens and links with HMAC so it can be passed through untrusted clients and verified later; it signs but does not encrypt, so the content stays readable. For random tokens, use the standard library's secrets module rather than random.