Cargo

Cargo is Rust’s command-line package manager and build tool, suited to developers who want one workflow for dependencies, compilation, testing, and publishing. It is the sensible default for Rust projects; look elsewhere when you need a language-agnostic manager or cannot accept nightly-only capabilities.

Overview

Cargo handles the full Rust package lifecycle. It downloads dependencies, invokes rustc or another build tool with appropriate parameters, and provides commands for compiling, checking, documenting, testing, running, packaging, installing, and publishing packages. cargo new creates a binary package by default, while --lib starts a library package.

Dependency sources include crates.io, alternate registries, Git repositories, and local filesystem paths. Lockfiles support repeatable builds, and workspaces let multiple packages share a Cargo.lock file and output directory. The limitation is deliberate: Cargo is for Rust packages, not a general dependency system across languages.

Key features

Dependencies and registries

Crates.io is the default registry, with alternate registries configured through .cargo/config.toml and usable via Git or sparse protocols. Private-registry authentication is built in. Credential providers can place tokens in Windows Credential Manager, macOS Keychain, or libsecret; the cargo:token provider stores tokens as unencrypted text, so credential choice matters.

Builds, features, and workspaces

Cargo passes the correct build parameters to the compiler and supports package features for conditional compilation and optional dependencies. Teams can enable those features from the command line with flags such as --features. Workspaces are valuable for monorepos because related packages share dependency locking and build output, reducing duplicated management.

Offline and publishing workflows

Setting net.offline to true or using --offline prevents network access and attempts to build from cached data. That is useful for restricted networks and repeatable automation, but it cannot supply packages that are not already cached. Cargo can create distributable packages, upload them to crates.io, and yank a published version so new resolution avoids it while existing lockfiles continue using it.

Automation and extensibility

Guidance covers build and test jobs for GitHub Actions, GitLab CI, builds.sr.ht, and CircleCI. New subcommands can extend Cargo without changing the core program. Some documented capabilities are unstable: they require a nightly toolchain and -Z flags, which is a material constraint for teams committed to stable Rust.

Pricing

Cargo costs free on its free plan. There is no trial because the plan is free, and no seats, quotas, renewal charges, or paid tiers apply. Every Rust developer can use the complete package manager and build-tool workflow without a subscription. Cargo is open source, primarily under the MIT and Apache License 2.0 licenses.

Platforms

Cargo is included with the Rust toolchain installed through rustup. Installation instructions cover Windows, macOS, and Linux, with support also extending to other Unix-like systems. It runs through a command-line interface, so suitability depends on comfort with terminal-based development rather than a graphical workflow.

Who it's for

Cargo is for Rust developers building binaries, libraries, or multi-package workspaces, including teams that need private registries, lockfile-based reproducibility, offline operation, and CI examples. It is particularly strong when dependency acquisition, compilation, testing, packaging, and crates.io publishing should share one tool. Choose another manager for projects whose primary ecosystem is JavaScript, Python, C/C++, or another language.

Pros and cons

Pro: Covers dependency resolution, builds, checks, tests, documentation, packaging, installation, and publishing in one Rust-native workflow.

Pro: Lockfiles, workspaces, alternate registries, Git and path dependencies, and offline mode support controlled and repeatable builds.

Pro: Private-registry credential providers integrate with major desktop secret stores.

Con: Its scope is limited to Rust packages and a command-line workflow.

Con: Unstable features require nightly Rust and -Z flags, complicating stable-toolchain policies.

Con: The cargo:token credential provider keeps tokens unencrypted.

Alternatives

Package Managers is the broader category overview for comparing ecosystems. Choose npm for JavaScript and Node.js projects, with a free tier for public package authors and paid plans beyond that use case. Choose uv for a free, open-source Python package workflow. Gradle is the better fit when you need a general build system spanning API, Linux, macOS, and Windows. Yarn and pnpm are free JavaScript package-manager alternatives. Conan targets C and C++ package and binary management. pip is the straightforward free choice for Python packages. vcpkg is a free, open-source option for C and C++ across desktop and mobile platforms.

Verdict

Cargo is the right choice for Rust developers who want a free, integrated command-line system for dependencies, reproducible builds, testing, workspaces, and publishing. Its main reason to look elsewhere is equally clear: it is Rust-specific, and its unstable features demand nightly Rust rather than a stable-only toolchain.