Cargo

Cargo is the package manager and build tool for Rust packages, best suited to developers who want one command-line workflow for dependencies and the package lifecycle. It is a strong fit for Rust projects, but not a general-purpose manager for other languages.

Overview

Cargo fetches dependencies, invokes rustc or another build tool with the appropriate parameters, and provides commands to compile, check, document, test, run, package, install, and publish Rust packages. The cargo new command creates a binary package by default; use --lib to start a library. This breadth makes Cargo a practical foundation for routine Rust development, rather than just a way to download libraries.

Projects can depend on crates.io packages, alternate registries, Git repositories, or local paths. Lockfiles help make builds repeatable, and workspaces let related packages share a lockfile and output directory. The trade-off is specialization: Cargo is designed around Rust packages, not development across multiple languages.

Key features

Dependencies, registries, and credentials

Crates.io is the default registry, while alternate registries can be configured in .cargo/config.toml and use Git or sparse protocols. Cargo also supports private registry authentication, with credential providers that can store tokens in Windows Credential Manager, macOS Keychain, or libsecret. Its cargo:token provider stores tokens as unencrypted text, so users should choose a credential provider with storage appropriate to their security needs.

Conditional features can enable optional dependencies or compilation paths, including through command-line flags such as --features. Cargo can also mark a published crate version as yanked, preventing new dependency resolution from selecting it while existing lockfiles continue to use it. These controls give package maintainers useful ways to shape dependencies and handle problematic releases.

Offline builds and extensibility

With --offline or net.offline enabled, Cargo avoids network access and attempts to proceed using locally cached data. That is useful in disconnected environments, though it depends on the needed packages already being cached. New subcommands can extend Cargo without changing Cargo itself, giving teams room to add workflow-specific commands.

The Cargo Book includes a guide, command reference, FAQ, glossary, Git authentication appendix, and changelog. Its CI guide provides build and test examples for GitHub Actions, GitLab CI, builds.sr.ht, and CircleCI. Some documented features remain unstable and require a nightly toolchain and -Z flags, which matters if a project needs functionality beyond the stable release.

Pricing

Cargo is free: the Cargo plan costs free. There is no paid tier or trial to weigh against it; Cargo is open source and primarily distributed under the MIT and Apache License, Version 2.0. The documented rustup installer installs Cargo alongside the stable Rust release.

Platforms

Cargo is available for Linux, macOS, and Windows, with installation instructions also covering other Unix-like systems. Its command-line interface suits developers comfortable working from a terminal. Since Cargo is included with the Rust toolchain, it is a natural choice for Rust development on supported systems.

Who it's for

Cargo is the right choice for Rust developers who need dependency resolution, repeatable builds, package creation, testing, and publishing in one tool. Workspaces and multiple dependency sources also suit projects that combine related packages or use private and Git-hosted dependencies. Developers who need an interface beyond the command line, or a package manager for a different language, should look elsewhere.

Pros and cons

• Pros: Covers building, testing, documentation, packaging, installation, and publishing, reducing the need to assemble separate tools for these Rust package tasks.
• Pros: Supports lockfiles, workspaces, private registries, and offline operation, which helps with repeatability and varied development environments.
• Pros: Free, open source, and included with the Rust toolchain, with support for Linux, macOS, Windows, and other Unix-like systems.
• Cons: Its focus on Rust packages makes it a poor fit for managing dependencies across other languages.
• Cons: Some features require nightly Rust and -Z flags, so projects relying on them cannot stay entirely on the stable toolchain.
• Cons: The cargo:token provider stores credentials as unencrypted text, so users need to choose their credential storage with care.

Alternatives

If you are choosing a package manager outside Rust, compare package managers by language and workflow. For JavaScript, npm is an alternative with a free plan for public package authors and paid options. Python developers can consider uv, while Yarn is another free package manager with no paid plans or usage limits stated. For build workflows, Gradle is a free, open-source build system.

Other language-specific options include pip for Python, Apache Maven for Java projects requiring JDK 8 or later for Maven 3.10, vcpkg for C and C++, and Composer for PHP dependency management. These are alternatives when the project’s language or build workflow calls for them, rather than replacements for Cargo in Rust development.

Verdict

Rust developers who want a free command-line tool for dependencies, builds, and package publishing should choose Cargo. Its broad package workflow, workspace support, and registry flexibility make it the practical fit for Rust projects. Look elsewhere for cross-language dependency management, or check whether a required feature is stable before committing to a stable-only toolchain.