PyPI
pypi.org
What it is
PyPI is a repository for software written in Python, available through its website and APIs. It helps users find and install packages shared by the Python community, while package authors publish projects and releases. A release may include source archives and binary wheels for different hardware, operating systems, and formats. APIs include RSS feeds for new packages and releases. PyPI is maintained by the Python Software Foundation and the Python community. Accounts require two-factor authentication, and a verified email address is needed to register a project or upload a release file. Trusted Publishing uses OpenID Connect short-lived identity tokens, with PyPI API tokens valid for 15 minutes. Default limits are 100 MB per file and 10 GB per project. Organizations provide shared profiles, teams, permissions, trusted publishing, and history. Community organizations are free; Company organizations cost $5 a month.
Spec sheet
- What it does
- PyPI is a repository where Python software is published, discovered, downloaded, and installed.Read 15 Oct 2026 · pypi.org
- Purpose
- PyPI is a repository of software for the Python programming language.Read 1 Oct 2026 · pypi.org
- API
- PyPI provides JSON, Index, Upload, Integrity, Stats, RSS, secret-reporting, and public dataset interfaces.Read 15 Oct 2026 · docs.pypi.org
- Founded
- LinkedIn lists the Python Software Foundation as founded in 2001.Read 15 Oct 2026 · linkedin.com
- Maker
- PyPI is developed and maintained by the Python Software Foundation and the Python community.Read 15 Oct 2026 · pypi.org
- Account security
- Two-factor authentication is required on PyPI accounts.Read 1 Oct 2026 · pypi.org
- API access
- PyPI provides APIs, including RSS feeds for new packages and releases.Read 1 Oct 2026 · pypi.org
- API limitation
- New integrations are advised to avoid XML-RPC because PyPI plans to deprecate those APIs.Read 15 Oct 2026 · docs.pypi.org
- API policy
- JSON, RSS, and Index API responses are cached and expose ETag headers for conditional requests.Read 15 Oct 2026 · docs.pypi.org
- Attestations
- PyPI accepts SLSA Provenance and PyPI Publish attestation predicates and supports up to two attestations per uploaded release file.Read 1 Oct 2026 · docs.pypi.org
- Authentication
- PyPI requires two-factor authentication for web login and supports TOTP applications, WebAuthn security devices, and recovery codes.Read 15 Oct 2026 · pypi.org
- Community role
- The Python Software Foundation hosts PyPI, the Python package repository relied on by thousands of users and a huge range of projects.Read 1 Oct 2026 · python.org
- Company headquarters
- LinkedIn lists the Python Software Foundation headquarters in Beaverton, Oregon.Read 15 Oct 2026 · linkedin.com
- Company legal name
- Crunchbase lists the legal name as Python Software Foundation Inc.Read 15 Oct 2026 · crunchbase.com
- Company size
- LinkedIn lists the foundation's company size as 2–10 employees, while its public page shows 843 associated employee profiles.Read 15 Oct 2026 · linkedin.com
- Current status
- The official status page reports no incident on October 15, 2026 and shows PyPI systems operational.Read 15 Oct 2026 · status.python.org
- Documentation depth
- The official documentation covers project management, organizations, trusted publishers, attestations, APIs, datasets, metadata, storage, yanking, and support topics.Read 15 Oct 2026 · docs.pypi.org
- Installation
- The Python Packaging User Guide documents installing PyPI packages with Python and pip on Unix/macOS and Windows.Read 15 Oct 2026 · packaging.python.org
- Licence
- Warehouse, the software powering PyPI, is published under the Apache-2.0 licence.Read 15 Oct 2026 · github.com
- Limit: moderation capacity
- CSO reported that PyPI had more than 625,000 packages and only four full-time administrators, with one person serving as the sole security specialist at the time described.Read 15 Oct 2026 · csoonline.com
- Limit: supply-chain exposure
- Security research found 4,655 analyzed PyPI packages explicitly required at least one known-vulnerable dependency and 141,044 allowed vulnerable versions through dependency ranges.Read 15 Oct 2026 · arxiv.org
- Limit: typosquatting
- A documented campaign registered about 900 malicious typosquatted packages targeting 40 popular Python packages and delivered cryptocurrency-stealing malware.Read 15 Oct 2026 · veracode.com
- Maintainer
- PyPI is developed and maintained by the Python Software Foundation and the Python community.Read 1 Oct 2026 · pypi.org
- Mirroring
- The recommended project for running a PyPI mirror is bandersnatch, and storage requirements exceed 1 terabyte and are growing.Read 1 Oct 2026 · pypi.org
- Mirrors
- PyPI recommends bandersnatch for operating a mirror and warns that a mirror needs more than one terabyte of storage and growing.Read 15 Oct 2026 · pypi.org
- Nonprofit status
- The Python Software Foundation describes itself as a 501(c)(3) nonprofit organization.Read 15 Oct 2026 · python.org
- Organization features
- Organizations provide shared profiles, teams, publishing and maintenance permissions, trusted publishing, and organization history.Read 1 Oct 2026 · pypi.org
- Organizations
- Organization accounts provide shared branding, team permissions, project visibility controls, trusted publishing, and audit history.Read 15 Oct 2026 · pypi.org
- Outage: October 2026
- StatusGator recorded a 20-minute PyPI backends partial-availability outage beginning October 2, 2026, plus earlier September search and login incidents.Read 15 Oct 2026 · statusgator.com
- Package formats
- PyPI releases can provide source archives and binary wheels for different operating systems and hardware.Read 15 Oct 2026 · pypi.org
- Praise: easy installation
- G2 reviewers repeatedly praise installing Python packages with pip as easy and straightforward.Read 15 Oct 2026 · g2.com
- Praise: integration
- G2 reviewers describe PyPI packages as easy to integrate into Python applications and workflows.Read 15 Oct 2026 · g2.com
- Project metadata
- PyPI displays standardized project metadata such as classifiers, dependencies, descriptions, URLs, and license information.Read 15 Oct 2026 · docs.pypi.org
- Project pages
- A PyPI project groups releases, files, metadata, documentation links, and related information under one project name.Read 15 Oct 2026 · pypi.org
- Publishing requirement
- A verified email address is required to register a new project or upload a new version or file.Read 1 Oct 2026 · pypi.org
- Rating on G2
- 4.4 out of 5 stars from 12 reviews.Read 15 Oct 2026 · g2.com
- Scale
- The homepage currently lists 916,427 projects, 9,886,164 releases, 22,061,025 files, and 1,127,767 users.Read 15 Oct 2026 · pypi.org
- Security reporting
- Security issues in PyPI itself are reported privately to [email protected], while malicious hosted projects can be reported through a project malware-reporting workflow.Read 15 Oct 2026 · pypi.org
- Self-hosting
- The Warehouse codebase that powers PyPI can be run locally with Docker for development and testing.Read 15 Oct 2026 · github.com
- Storage limits
- The default limits are 100.0 MB per individual file and 10.0 GB for the total size of a project.Read 1 Oct 2026 · docs.pypi.org
- Support channels
- Warehouse contributors and users can seek help through GitHub issues, IRC, PyPA Discord, and Python Discourse.Read 15 Oct 2026 · github.com
- Supported publishers
- PyPI Trusted Publishers support GitHub Actions, Google Cloud, ActiveState, and GitLab CI/CD.Read 1 Oct 2026 · docs.pypi.org
- System requirement
- The installation guide requires a working Python interpreter and pip; Linux users may need to install pip separately through their distribution.Read 15 Oct 2026 · packaging.python.org
- Transport security
- PyPI states that TLS protects connections between users and the service.Read 15 Oct 2026 · pypi.org
- Trusted publishing
- Trusted Publishing uses OpenID Connect short-lived identity tokens so automated publishers can upload without manually generated API tokens.Read 15 Oct 2026 · docs.pypi.org
- Users
- PyPI helps people find and install software developed and shared by the Python community, while package authors use it to distribute software.Read 1 Oct 2026 · pypi.org
Plans and prices
Community organization Free All organization features · No payment or billing information required · Applications reviewed by PyPI team Read 1 Oct 2026 · pypi.org
Community Organization Free No payment or billing information required All current organization features · qualifying community projects · application review Read 15 Oct 2026 · docs.pypi.org
Company organization $5 a month Billed monthly by card through Stripe All current organization features · Applications reviewed by PyPI team Read 1 Oct 2026 · pypi.org
Corporate Organization $5 a month Invoiced monthly based on usage; due upon receipt $5 per member User · organization features · application review Read 15 Oct 2026 · docs.pypi.org
Strong points and limits
Strong points
- Python package repository with web and API access
- Source archives and binary wheels are supported
- Two-factor authentication is required for accounts
- Organizations include teams and publishing permissions
- Free Community organization option
Limits
- Private packages are not supported
- Individual files are limited to 100 MB
- Projects are limited to 10 GB by default
- Company organization costs $5 a month
Who it suits
PyPI suits Python users looking for installable packages and authors distributing Python software. Organizations can use shared teams, permissions, and publishing controls.
Verdict
PyPI combines package discovery, publishing, APIs, and organization controls for Python software. Its limits and lack of private packages matter when planning distribution.
Where Specifiction places it
- Package Registries#6 of 288.8
