PyPI

Free plan Open source APILinuxMacSelf-hostedWebWindows

What PyPI is

PyPI is a repository for software written in Python. It helps people discover and install packages shared by the Python community, while package authors use it to distribute their work. Releases may include several files, such as source archives and binary wheels for different hardware and operating systems. PyPI is accessible on the web and through APIs, including RSS feeds for package and release updates. The Python Software Foundation and the Python community maintain it. Accounts require two-factor authentication, and a verified email address is needed to register a project or upload a release file. Trusted Publishing uses OpenID Connect and short-lived identity tokens; PyPI API tokens are valid for 15 minutes. Organizations can use shared profiles, teams, publishing and maintenance permissions, trusted publishing, and organization history. The default file limit is 100.0 MB, with a 10.0 GB total project limit. PyPI offers a free Community organization and a Company organization for $5 a month. Private packages are not supported.

Who it suits

PyPI suits Python users looking for community-published software and authors distributing Python packages. Its organization features may suit teams managing publishing and maintenance permissions.

What it does well

Web access and APIs, including RSS feeds.
Releases can include source archives and binary wheels.
Organizations provide teams and role-based permissions.
Free Community organization requires no payment details.

What to know first

Private packages are not supported.
Individual files are limited to 100.0 MB.
Projects default to a 10.0 GB total size limit.
Publishing requires a verified email address.

Limits

The default limit is 100.0 MB per individual file and 10.0 GB for a project's total size. Private packages are not supported. Company organizations cost $5 a month; Community organizations are free.

Plans

Plan	Billed and limits	Price
Community Organization	No payment or billing information required · All current organization features · qualifying community projects · application review	Free
Company organization	Billed monthly by card through Stripe · All current organization features · Applications reviewed by PyPI team	$5 a month
Corporate Organization	Invoiced monthly based on usage; due upon receipt · $5 per member User · organization features · application review	$5 a month

As pypi.org lists them, read 15 Oct 2026. The maker's own page has the final word.

Getting started

Visit https://pypi.org/ on the web or use PyPI's API.
Create a PyPI account and enable two-factor authentication.
Verify an email address before registering a project or uploading a release.
Choose a Community organization for free or a Company organization for $5 a month if organization features are needed.

Verdict

PyPI provides package discovery and distribution for Python, with APIs and organization tools alongside individual accounts. Check its file limits and lack of private packages against your needs.

Questions

Is PyPI free?

PyPI has a free plan. Community organizations cost nothing; Company organizations cost $5 a month, billed monthly by card through Stripe.

What platforms does PyPI support?

PyPI is available on the web and through its API.

Can I host private packages?

No. Private packages are not supported.

What are PyPI's storage limits?

The default limits are 100.0 MB per individual file and 10.0 GB for a project's total size.

Who maintains PyPI?

The Python Software Foundation and the Python community develop and maintain PyPI.

What do PyPI organizations include?

Organizations include shared profiles, teams, publishing and maintenance permissions, trusted publishing, and organization history.

Facts from PyPI's own pages

Account security: Two-factor authentication is required on PyPI accounts. · pypi.org, 1 Oct 2026
API: PyPI provides JSON, Index, Upload, Integrity, Stats, RSS, secret-reporting, and public dataset interfaces. · docs.pypi.org, 15 Oct 2026
API access: PyPI provides APIs, including RSS feeds for new packages and releases. · pypi.org, 1 Oct 2026
API limitation: New integrations are advised to avoid XML-RPC because PyPI plans to deprecate those APIs. · docs.pypi.org, 15 Oct 2026
API policy: JSON, RSS, and Index API responses are cached and expose ETag headers for conditional requests. · docs.pypi.org, 15 Oct 2026
Attestations: PyPI accepts SLSA Provenance and PyPI Publish attestation predicates and supports up to two attestations per uploaded release file. · docs.pypi.org, 1 Oct 2026
Authentication: PyPI requires two-factor authentication for web login and supports TOTP applications, WebAuthn security devices, and recovery codes. · pypi.org, 15 Oct 2026
Community role: The Python Software Foundation hosts PyPI, the Python package repository relied on by thousands of users and a huge range of projects. · python.org, 1 Oct 2026
Company headquarters: LinkedIn lists the Python Software Foundation headquarters in Beaverton, Oregon. · linkedin.com, 15 Oct 2026
Company legal name: Crunchbase lists the legal name as Python Software Foundation Inc. · crunchbase.com, 15 Oct 2026
Company size: LinkedIn lists the foundation's company size as 2–10 employees, while its public page shows 843 associated employee profiles. · linkedin.com, 15 Oct 2026
Current status: The official status page reports no incident on October 15, 2026 and shows PyPI systems operational. · status.python.org, 15 Oct 2026
Documentation depth: The official documentation covers project management, organizations, trusted publishers, attestations, APIs, datasets, metadata, storage, yanking, and support topics. · docs.pypi.org, 15 Oct 2026
Founded: LinkedIn lists the Python Software Foundation as founded in 2001. · linkedin.com, 15 Oct 2026
Installation: The Python Packaging User Guide documents installing PyPI packages with Python and pip on Unix/macOS and Windows. · packaging.python.org, 15 Oct 2026
Licence: Warehouse, the software powering PyPI, is published under the Apache-2.0 licence. · github.com, 15 Oct 2026
Limit: moderation capacity: CSO reported that PyPI had more than 625,000 packages and only four full-time administrators, with one person serving as the sole security specialist at the time described. · csoonline.com, 15 Oct 2026
Limit: supply-chain exposure: Security research found 4,655 analyzed PyPI packages explicitly required at least one known-vulnerable dependency and 141,044 allowed vulnerable versions through dependency ranges. · arxiv.org, 15 Oct 2026
Limit: typosquatting: A documented campaign registered about 900 malicious typosquatted packages targeting 40 popular Python packages and delivered cryptocurrency-stealing malware. · veracode.com, 15 Oct 2026
Maintainer: PyPI is developed and maintained by the Python Software Foundation and the Python community. · pypi.org, 1 Oct 2026
Maker: PyPI is developed and maintained by the Python Software Foundation and the Python community. · pypi.org, 15 Oct 2026
Mirroring: The recommended project for running a PyPI mirror is bandersnatch, and storage requirements exceed 1 terabyte and are growing. · pypi.org, 1 Oct 2026
Mirrors: PyPI recommends bandersnatch for operating a mirror and warns that a mirror needs more than one terabyte of storage and growing. · pypi.org, 15 Oct 2026
Nonprofit status: The Python Software Foundation describes itself as a 501(c)(3) nonprofit organization. · python.org, 15 Oct 2026

Where PyPI stands on Freedom251

Package Registries#3 of 28