This page describes the pricing information for Cloud KMS. Prices are effective March 17, 2025.

Cloud Key Management Service charges for usage based on the following price sheet. A bill is sent out at the end of each billing cycle, listing previous usage and charges. Prices on this page are listed in US dollars (USD).

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

Important: You must sign up for billing before you can start using Cloud KMS.

Cloud KMS pricing is based on the number of active key versions, the protection level on the key versions, and a usage rate for key operations. For keys with protection level SOFTWARE, asymmetric keys and symmetric keys have the same price.

As part of the Google Cloud Free Tier, Cloud KMS lets you use keys created using Cloud KMS Autokey for free up to specific limits. These usage limits are available both during and after the free trial period. If you are no longer in the free trial period, usage beyond these Always Free limits is charged according to the pricing table above.

1. Prices do not include any charges that may be imposed by the external key management partner's system.
2. A key version is active if it is in any of these states:
3. Enabled
4. Disabled
5. Scheduled for destruction
6. Cloud KMS bills monthly for the number of active key versions which you have for the month. This is not rounded but based on actual consumption. That is, if you had a key version that was active for only 2 days, you would be billed proportional to that usage, and not for the whole month.
7. A cryptographic operation is any form of encryption, decryption, signing, or generating random bytes.
8. All billable items are billed to the project that owns the key, even for CMEK keys that operate on a resource owned by another project.
9. Cloud KMS bills cryptographic operations per 10,000 operations. This is not rounded but based on actual consumption. That is, if your project performed 25,000 cryptographic operations, you would be billed for 2.5 times 10,000 operations.
10. Monthly free usage limits are aggregated across projects by billing account and reset every month; you are billed only for usage past the monthly free usage limits.
11. Monthly free cryptographic key operations only apply to operations performed using key versions created using Cloud KMS Autokey.
12. Rotating a key—creating a new key version—is an administrative operation that is always free. Re-encrypting data to use the new key version counts toward your cryptographic key operations.

In this example, we show a simple scenario that might apply if you are just getting started with Cloud KMS. We use a monthly billing period to simplify the calculations.

Suppose you have the following key usage pattern in a given month:

• 100 keys (CryptoKeys) with protection level SOFTWARE, with each key having 5 active versions, for a total of 500 key versions (CryptoKeyVersions).
• 100,000 key use operations for symmetric encryption and decryption, or signing and verification. (Key admin operations are free.)
• 10,000 key use operations for retrieval of a public key for an asymmetric key.
• 50,000 key use operations for asymmetric signing.

Your bill for the month would be calculated as follows:

• 500 key versions at $0.06: $30.00.
• 100,000 key use operations for symmetric encryption and decryption (or signing and verification) at $0.03 per 10,000 operations: $0.30.
• 10,000 key use operations for retrieval of a public key at $0.03 per 10,000 operations: $0.03.
• 50,000 key use operations for asymmetric signing at $0.03 per 10,000 operations: $0.15.

Total for this pricing example: $30.48

This section explains Single-tenant Cloud HSM details.

Each instance of Single-tenant Cloud HSM is charged a flat monthly fee.

Each instance consists of a dedicated cluster HSM partitions.

Single-tenant Cloud HSM is available in limited regions. See Cloud KMS locations for details.

Charges are incurred as follows:

• Your project starts incurring Single-tenant Cloud HSM charges when you create an instance. Whether you use the instance or not, you are charged based on the provisioned capacity.
• Pricing is prorated per day.
• Each instance supports a maximum of 15,000 key versions.
• There is no additional charge for key versions or key operations.

Suppose you have following usage for Single-tenant Cloud HSM:

• Single-tenant Cloud HSM instance provisioned on 16th day of the billing cycle.
• 1,000 HSM keys version are provisioned.
• 1 million encrypt/decrypt operations performed.

Then, your bill for the month might resemble the following:

• Half month usage of one Single-tenant Cloud HSM instance: $1,750.
• No charge for key versions or key operations.

Your pricing total for the month: $1,750

Suppose you have following usage for Single-tenant Cloud HSM:

• One instance of Single-tenant Cloud HSM.
• 5,000 HSM key versions are provisioned.
• 20 million encrypt/decrypt operations.

Then, your bill for the month might resemble the following:

• One month usage of one Single-tenant Cloud HSM instance: $3,500.
• No charge for key versions or key operations.

Your pricing total for the month: $3,500

This section explains Cloud HSM for Google Workspace pricing details.

Each instance of Cloud HSM for Google Workspace is charged a flat monthly fee. Each instance has a capacity of 1,000 transactions per second.

Charges are incurred as follows:

• Your project starts incurring Cloud HSM for Google Workspace charges when you create an instance. Whether you use the instance or not, you're charged based on the provisioned capacity.
• Pricing is prorated per day.

Suppose you have following usage for Cloud HSM for Google Workspace:

• Cloud HSM for Google Workspace instance provisioned on 16th day of the billing cycle.
• One Cloud HSM key version is provisioned.
• 1 million encrypt/decrypt operations.

Then, your bill for the month might resemble the following:

• Half month usage of one Cloud HSM for Google Workspace instance: $1875.
• One Cloud HSM key version at $1: $1.
• 1 million operations at $0.03 per 10K operations: $3.

Your pricing total for the month: $1879

Suppose you have following usage for Cloud HSM for Google Workspace:

• One instance of Cloud HSM for Google Workspace.
• Two Cloud HSM key version are provisioned.
• 20 million encrypt/decrypt operations.

Then, your bill for the month might resemble the following:

• One month usage of one Cloud HSM for Google Workspace instance: $3750.
• Two Cloud HSM key versions at $1: $2.
• 20 million operations at $0.03 per 10,000 operations: $60.

Your pricing total for the month: $3812

The Google API Console provides a transaction history for each of your projects. This history describes your current balance and estimated resource usage for that particular project.

To view a project's transaction history, go to the estimated billing invoice page.