diff --git a/pkgs/tools/security/mkp224o/default.nix b/pkgs/tools/security/mkp224o/default.nix
new file mode 100644
index 000000000000..b649c57b3462
--- /dev/null
+++ b/pkgs/tools/security/mkp224o/default.nix
@@ -0,0 +1,47 @@
+{ stdenv, lib, fetchFromGitHub, autoreconfHook, libsodium }:
+
+stdenv.mkDerivation rec {
+  name = "mkp224o-${version}";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "cathugger";
+    repo = "mkp224o";
+    rev = "v${version}";
+    sha256 = "1m7r0jfm6na6rk75v1kals3bx2cs6jsfxdgpxdljn39j3qr4mxvd";
+  };
+
+  buildCommand =
+    let
+      # compile few variants with different implementation of crypto
+      # the fastest depends on a particular cpu
+      variants = [
+        { suffix = "ref10";         configureFlags = ["--enable-ref10"]; }
+        { suffix = "donna";         configureFlags = ["--enable-donna"]; }
+      ] ++ lib.optionals (stdenv.isi686 || stdenv.isx86_64) [
+        { suffix = "donna-sse2";    configureFlags = ["--enable-donna-sse2"]; }
+      ] ++ lib.optionals stdenv.isx86_64 [
+        { suffix = "amd64-51-30k";  configureFlags = ["--enable-amd64-51-30k"]; }
+        { suffix = "amd64-64-20k";  configureFlags = ["--enable-amd64-64-24k"]; }
+      ];
+    in
+      lib.concatMapStrings ({suffix, configureFlags}: ''
+        install -D ${
+          stdenv.mkDerivation {
+            name = "mkp224o-${suffix}-${version}";
+            inherit version src configureFlags;
+            nativeBuildInputs = [ autoreconfHook ];
+            buildInputs = [ libsodium ];
+            installPhase = "install -D mkp224o $out";
+          }
+        } $out/bin/mkp224o-${suffix}
+      '') variants;
+
+  meta = with lib; {
+    description = "Vanity address generator for tor onion v3 (ed25519) hidden services";
+    homepage = http://cathug2kyi4ilneggumrenayhuhsvrgn6qv2y47bgeet42iivkpynqad.onion/;
+    license = licenses.cc0;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ volth ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5429068c0ba6..c985ff8f9947 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4209,6 +4209,8 @@ in
 
   mkcue = callPackage ../tools/cd-dvd/mkcue { };
 
+  mkp224o = callPackage ../tools/security/mkp224o { };
+
   mkpasswd = hiPrio (callPackage ../tools/security/mkpasswd { });
 
   mkrand = callPackage ../tools/security/mkrand { };