PyPI
What it is
PyPI is a repository for software written in Python. It helps people find and install packages shared by the Python community, and gives package authors a place to distribute their work. Releases can include multiple downloadable files, such as source archives and binary wheels for different hardware, operating systems, and file formats. PyPI is available on the web and through APIs, including RSS feeds for new packages and releases. Accounts require two-factor authentication, and a verified email address is needed to register a project or upload a release. Trusted Publishing uses OpenID Connect and short-lived identity tokens; PyPI API tokens issued through this process last 15 minutes. Organizations add shared profiles, teams, publishing and maintenance permissions, trusted publishing, and organization history. The free Community organization requires no payment or billing information. The Company organization costs $5 a month, billed monthly by card through Stripe. Default limits are 100.0 MB per file and 10.0 GB per project. PyPI is maintained by the Python Software Foundation and the Python community.
For and against
For
- Free Community organization requires no payment details.
- APIs include RSS feeds for packages and releases.
- Supports source archives and binary wheels.
- Organizations include teams and publishing permissions.
Against
- Private packages are not supported.
- Files are limited to 100.0 MB by default.
- Projects are limited to 10.0 GB by default.
- Publishing requires a verified email address.
The verdict
PyPI brings Python package discovery and distribution together, with APIs and organization features for collaborative publishing. Review its default storage limits and lack of private packages before choosing it for a project.
Who it suits
PyPI suits Python users looking for packages and authors who want to distribute them. Organizations can use shared profiles, teams, and publishing permissions.
Plans and prices
Community Organization
All current organization features · qualifying community projects · application review
Read 15 Oct 2026 · docs.pypi.org
Corporate Organization
$5 per member User · organization features · application review
Read 15 Oct 2026 · docs.pypi.org
Company organization
All current organization features · Applications reviewed by PyPI team
Read 1 Oct 2026 · pypi.org
On the record
- Account security
- Two-factor authentication is required on PyPI accounts.pypi.org · read 1 Oct 2026
- API
- PyPI provides JSON, Index, Upload, Integrity, Stats, RSS, secret-reporting, and public dataset interfaces.docs.pypi.org · read 15 Oct 2026
- API access
- PyPI provides APIs, including RSS feeds for new packages and releases.pypi.org · read 1 Oct 2026
- API limitation
- New integrations are advised to avoid XML-RPC because PyPI plans to deprecate those APIs.docs.pypi.org · read 15 Oct 2026
- API policy
- JSON, RSS, and Index API responses are cached and expose ETag headers for conditional requests.docs.pypi.org · read 15 Oct 2026
- Attestations
- PyPI accepts SLSA Provenance and PyPI Publish attestation predicates and supports up to two attestations per uploaded release file.docs.pypi.org · read 1 Oct 2026
- Authentication
- PyPI requires two-factor authentication for web login and supports TOTP applications, WebAuthn security devices, and recovery codes.pypi.org · read 15 Oct 2026
- Community role
- The Python Software Foundation hosts PyPI, the Python package repository relied on by thousands of users and a huge range of projects.python.org · read 1 Oct 2026
- Company headquarters
- LinkedIn lists the Python Software Foundation headquarters in Beaverton, Oregon.linkedin.com · read 15 Oct 2026
- Company legal name
- Crunchbase lists the legal name as Python Software Foundation Inc.crunchbase.com · read 15 Oct 2026
- Company size
- LinkedIn lists the foundation's company size as 2–10 employees, while its public page shows 843 associated employee profiles.linkedin.com · read 15 Oct 2026
- Current status
- The official status page reports no incident on October 15, 2026 and shows PyPI systems operational.status.python.org · read 15 Oct 2026
- Documentation depth
- The official documentation covers project management, organizations, trusted publishers, attestations, APIs, datasets, metadata, storage, yanking, and support topics.docs.pypi.org · read 15 Oct 2026
- Installation
- The Python Packaging User Guide documents installing PyPI packages with Python and pip on Unix/macOS and Windows.packaging.python.org · read 15 Oct 2026
- Licence
- Warehouse, the software powering PyPI, is published under the Apache-2.0 licence.github.com · read 15 Oct 2026
- Limit: moderation capacity
- CSO reported that PyPI had more than 625,000 packages and only four full-time administrators, with one person serving as the sole security specialist at the time described.csoonline.com · read 15 Oct 2026
- Limit: supply-chain exposure
- Security research found 4,655 analyzed PyPI packages explicitly required at least one known-vulnerable dependency and 141,044 allowed vulnerable versions through dependency ranges.arxiv.org · read 15 Oct 2026
- Limit: typosquatting
- A documented campaign registered about 900 malicious typosquatted packages targeting 40 popular Python packages and delivered cryptocurrency-stealing malware.veracode.com · read 15 Oct 2026
