diff --git a/bin/tests/system/tools/clean.sh b/bin/tests/system/tools/clean.sh
deleted file mode 100644
index 32a8e9736d..0000000000
--- a/bin/tests/system/tools/clean.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-rm -f NSEC3
-rm -f nsec3hash
-rm -f nsec3param
-rm -f testcases
diff --git a/bin/tests/system/tools/setup.sh b/bin/tests/system/tools/setup.sh
deleted file mode 100644
index b8ae3b4aa8..0000000000
--- a/bin/tests/system/tools/setup.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# shellcheck source=conf.sh
-. ../conf.sh
-
-$SHELL clean.sh
diff --git a/bin/tests/system/tools/tests.sh b/bin/tests/system/tools/tests.sh
deleted file mode 100644
index 835c325737..0000000000
--- a/bin/tests/system/tools/tests.sh
+++ /dev/null
@@ -1,145 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-. ../conf.sh
-
-status=0
-
-checkout() {
-  rc=$1
-  case $rc in
-    0) : ok ;;
-    *)
-      echo_i "failed"
-      status=$((status + 1))
-      return 1
-      ;;
-  esac
-  case $out in
-    *$hash*) : ok ;;
-    *)
-      echo_i "expect $hash"
-      echo_i "output $out"
-      echo_i "failed"
-      status=$((status + 1))
-      ;;
-  esac
-}
-
-# test cases taken from RFC 5155 appendix A
-algo=1 flags=0 iters=12 salt="aabbccdd"
-while read name hash; do
-  echo_i "checking $NSEC3HASH $name"
-  {
-    out=$($NSEC3HASH $salt $algo $iters $name)
-    rc=$?
-  } || true
-  checkout $rc
-
-  echo_i "checking $NSEC3HASH -r $name"
-  {
-    out=$($NSEC3HASH -r $algo $flags $iters $salt $name)
-    rc=$?
-  } || true
-  checkout $rc
-
-done <<EOF
-*.w.example R53BQ7CC2UVMUBFU5OCMM6PERS9TK9EN
-2t7b4g4vsa5smi47k61mv5bv1a22bojr.example KOHAR7MBB8DC2CE8A9QVL8HON4K53UHI
-a.example 35MTHGPGCU1QG68FAB165KLNSNK3DPVL
-ai.example GJEQE526PLBF1G8MKLP59ENFD789NJGI
-example 0P9MHAVEQVM6T7VBL5LOP2U3T2RP3TOM
-ns1.example 2T7B4G4VSA5SMI47K61MV5BV1A22BOJR
-ns2.example Q04JKCEVQVMU85R014C7DKBA38O0JI5R
-w.example K8UDEMVP1J2F7EG6JEBPS17VP3N8I58H
-x.w.example B4UM86EGHHDS6NEA196SMVMLO4ORS995
-x.y.w.example 2VPTU5TIMAMQTTGL4LUU9KG21E0AOR3S
-xx.example T644EBQK9BIBCNA874GIVR6JOJ62MLHV
-y.w.example JI6NEOAEPV8B5O6K4EV33ABHA8HT9FGC
-EOF
-
-# test empty salt
-checkempty() {
-  rc=$1
-  hash=CK0POJMG874LJREF7EFN8430QVIT8BSM checkout $rc \
-    && hash=- checkout $rc
-}
-name=com algo=1 flags=1 iters=0
-echo_i "checking $NSEC3HASH '' $name"
-{
-  out=$($NSEC3HASH '' $algo $iters $name)
-  rc=$?
-} || true
-checkempty $rc
-echo_i "checking $NSEC3HASH - $name"
-{
-  out=$($NSEC3HASH - $algo $iters $name)
-  rc=$?
-} || true
-checkempty $rc
-echo_i "checking $NSEC3HASH -- '' $name"
-{
-  out=$($NSEC3HASH -- '' $algo $iters $name)
-  rc=$?
-} || true
-checkempty $rc
-echo_i "checking $NSEC3HASH -- - $name"
-{
-  out=$($NSEC3HASH -- - $algo $iters $name)
-  rc=$?
-} || true
-checkempty $rc
-echo_i "checking $NSEC3HASH -r '' $name"
-{
-  out=$($NSEC3HASH -r $algo $flags $iters '' $name)
-  rc=$?
-} || true
-checkempty $rc
-echo_i "checking $NSEC3HASH -r - $name"
-{
-  out=$($NSEC3HASH -r $algo $flags $iters - $name)
-  rc=$?
-} || true
-checkempty $rc
-
-checkfail() {
-  rc=$1
-  case $rc in
-    0)
-      echo_i "failed to fail"
-      status=$((status + 1))
-      return 1
-      ;;
-  esac
-}
-echo_i "checking $NSEC3HASH missing args"
-{
-  out=$($NSEC3HASH 00 1 0 2>&1)
-  rc=$?
-} || true
-checkfail $rc
-echo_i "checking $NSEC3HASH extra args"
-{
-  out=$($NSEC3HASH 00 1 0 two names 2>&1)
-  rc=$?
-} || true
-checkfail $rc
-echo_i "checking $NSEC3HASH bad option"
-{
-  out=$($NSEC3HASH -? 2>&1)
-  rc=$?
-} || true
-checkfail $rc
-
-echo_i "exit status: $status"
-[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/tools/tests_sh_tools.py b/bin/tests/system/tools/tests_sh_tools.py
deleted file mode 100644
index 319a0fe63a..0000000000
--- a/bin/tests/system/tools/tests_sh_tools.py
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-
-def test_tools(run_tests_sh):
-    run_tests_sh()
diff --git a/bin/tests/system/tools/tests_tools_nsec3hash.py b/bin/tests/system/tools/tests_tools_nsec3hash.py
new file mode 100644
index 0000000000..67709f271e
--- /dev/null
+++ b/bin/tests/system/tools/tests_tools_nsec3hash.py
@@ -0,0 +1,122 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import os
+import subprocess
+
+import pytest
+
+import isctest
+
+NSEC3HASH = os.environ.get("NSEC3HASH")
+
+
+# test cases from RFC 5155, Appendix A
+@pytest.mark.parametrize(
+    "domain,nsec3hash",
+    [
+        ("*.w.example", "R53BQ7CC2UVMUBFU5OCMM6PERS9TK9EN"),
+        (
+            "2t7b4g4vsa5smi47k61mv5bv1a22bojr.example",
+            "KOHAR7MBB8DC2CE8A9QVL8HON4K53UHI",
+        ),
+        ("a.example", "35MTHGPGCU1QG68FAB165KLNSNK3DPVL"),
+        ("ai.example", "GJEQE526PLBF1G8MKLP59ENFD789NJGI"),
+        ("example", "0P9MHAVEQVM6T7VBL5LOP2U3T2RP3TOM"),
+        ("ns1.example", "2T7B4G4VSA5SMI47K61MV5BV1A22BOJR"),
+        ("ns2.example", "Q04JKCEVQVMU85R014C7DKBA38O0JI5R"),
+        ("w.example", "K8UDEMVP1J2F7EG6JEBPS17VP3N8I58H"),
+        ("x.w.example", "B4UM86EGHHDS6NEA196SMVMLO4ORS995"),
+        ("x.y.w.example", "2VPTU5TIMAMQTTGL4LUU9KG21E0AOR3S"),
+        ("xx.example", "T644EBQK9BIBCNA874GIVR6JOJ62MLHV"),
+        ("y.w.example", "JI6NEOAEPV8B5O6K4EV33ABHA8HT9FGC"),
+    ],
+)
+def test_nsec3_hashes(domain, nsec3hash):
+    salt = "aabbccdd"
+    algorithm = "1"
+    iterations = "12"
+
+    output = isctest.run.cmd(
+        [NSEC3HASH, salt, algorithm, iterations, domain]
+    ).stdout.decode("utf-8")
+    assert nsec3hash in output
+
+    flags = "0"
+    output = isctest.run.cmd(
+        [NSEC3HASH, "-r", algorithm, flags, iterations, salt, domain]
+    ).stdout.decode("utf-8")
+    assert nsec3hash in output
+
+
+@pytest.mark.parametrize(
+    "salt_emptiness_args",
+    [
+        [""],
+        ["-"],
+        ["--", ""],
+        ["--", "-"],
+    ],
+)
+def test_nsec3_empty_salt(salt_emptiness_args):
+    algorithm = "1"
+    iterations = "0"
+    domain = "com"
+
+    output = isctest.run.cmd(
+        [NSEC3HASH] + salt_emptiness_args + [algorithm, iterations, domain]
+    ).stdout.decode("utf-8")
+    assert "CK0POJMG874LJREF7EFN8430QVIT8BSM" in output
+    assert "salt=-" in output
+
+
+@pytest.mark.parametrize(
+    "salt_emptiness_arg",
+    [
+        "",
+        "-",
+    ],
+)
+def test_nsec3_empty_salt_r(salt_emptiness_arg):
+    algorithm = "1"
+    flags = "1"
+    iterations = "0"
+    domain = "com"
+
+    output = isctest.run.cmd(
+        [
+            NSEC3HASH,
+            "-r",
+            algorithm,
+            flags,
+            iterations,
+            salt_emptiness_arg,
+            domain,
+        ]
+    ).stdout.decode("utf-8")
+    assert " - CK0POJMG874LJREF7EFN8430QVIT8BSM" in output
+
+
+@pytest.mark.parametrize(
+    "args",
+    [
+        [""],  # missing arg
+        ["two", "names"],  # extra arg
+    ],
+)
+def test_nsec3_missing_args(args):
+    with pytest.raises(subprocess.CalledProcessError):
+        isctest.run.cmd([NSEC3HASH, "00", "1", "0"] + args)
+
+
+def test_nsec3_bad_option():
+    with pytest.raises(subprocess.CalledProcessError):
+        isctest.run.cmd([NSEC3HASH, "-?"])