What PyPI does

PyPI (the Python Package Index) is the official, community-governed package repository for the Python programming language, operated by the Python Software Foundation, a US 501(c)(3) non-profit. Founded in 2003, the platform enables Python developers to discover, install, and publish software packages, currently hosting 838,703 projects, 9,000,092 releases, 19,691,368 files, and 1,077,306 registered user accounts across 41.5 TB of total package storage. The platform is built on Warehouse, an open-source codebase maintained at github.com/pypi/warehouse, and serves as the default distribution channel integrated into Python packaging tools including pip and uv.

The technical stack has evolved from a basic package index into supply-chain security infrastructure. Core features include Trusted Publishers (OIDC-based publishing that eliminates long-lived API tokens), Digital Attestations implementing PEP 740 with SLSA Provenance verification, and a Secret Reporting API that enables third parties such as GitHub and deps.dev to automatically revoke leaked PyPI API tokens. Data services include BigQuery public datasets (streaming file_downloads and distribution_metadata) and three RSS feeds for monitoring package activity. Multiple REST APIs (JSON, Index PEP 503/691, Upload, Integrity, Stats) expose machine-readable access, and CDN-cached delivery via Fastly supports global downloads at scale.

PyPI operates as a non-commercial service with no pricing model or direct revenue stream. Funding derives from corporate infrastructure sponsorships (AWS for cloud and security, Google for download analytics, Datadog for monitoring, Fastly for CDN, and others) and donations to the PSF Packaging Workgroup. Operating cost allocation per available disclosure is approximately 25% bandwidth, 18% storage, 15% compute, and 12% malware mitigation. The registry's strategic significance has grown with AI/ML adoption: frameworks like LangChain and LiteLLM depend on PyPI, and the platform has faced repeated supply-chain attacks (LiteLLM compromise in March 2026 reaching ~40,000 downloads, Microsoft durabletask SDK compromise in May 2026, Hades campaign in June 2026). In September 2025, PyPI joined seven other major open-source foundations in a joint warning that current funding models for critical package registries are unsustainable.

Name

PyPI

Legal name

Python Software Foundation

Website

https://pypi.org

Company type

Private

Founded year

2003

Operating status

Operating

Headcount range

11–50 employees

Short description

PyPI is the official, non-profit Python Package Index operated by the Python Software Foundation, enabling Python developers to discover, install, and publish 838,000+ software packages used by 1M+ registered users worldwide.

Ownership category

akta.pro rank

Product category

Package Repository

NAICS

Software Publishers (51321)

SIC

Services-Prepackaged Software (7372)

akta.pro primary industry

Code & Repository Security (Git Security, Code Integrity) (HDADACAG)

Keywords

• Python package repository
• Software registry
• Package distribution
• Open source hosting
• Developer tooling

Headquarters

HQ city

Leicester

HQ country

United Kingdom

HQ region

Europe

Markets served

GTM type

B2C

Offering type

Software

Cost components

Infrastructure, Operations, Technology or R&D, Personnel

Distribution channels4 records

Marketing channels4 records

Core offering

PyPI is the official repository of software for the Python programming language, hosting 838,703 projects, 9,000,092 releases, and 19,691,368 files totaling 41.5 TB. It enables Python developers to find, install, and publish software packages through the Warehouse platform, supporting trusted publishing workflows, digital attestations (PEP 740), and SLSA provenance verification for supply chain security.

Product overview

PyPI is a unified package hosting platform and repository service for the Python programming language. The core offering is the package index itself, which hosts over 838,000 projects and 9 million releases. Security features include Trusted Publishers (OIDC-based cryptographic publishing workflow), Digital Attestations (PEP 740 implementation), and a Secret Reporting API for automatic token revocation. Data services include BigQuery public datasets, RSS feeds, and multiple REST APIs (JSON, Index, Upload, Integrity, Stats).

Differentiator

Problem solved

Functional benefit

Products and services

• PyPI (Python Package Index) The official repository of Python packages, hosting 838,703 projects, 9,000,092 releases, and 19,691,368 files. PyPI enables Python developers to find, install, and publish software packages through the Warehouse platform.
• Trusted Publishers OpenID Connect (OIDC)-based publishing workflow that eliminates the need for long-lived API tokens, allowing projects to publish from CI/CD systems like GitHub Actions with cryptographic identity verification.
• Digital Attestations PyPI's implementation of PEP 740, providing cryptographic attestations for package releases that bundle provenance information with publisher identity for supply chain security.
• BigQuery Public Datasets Public datasets including file_downloads (streaming download logs from Linehaul) and distribution_metadata (immutable metadata dump of all releases), licensed under Creative Commons Attribution 4.0.
• RSS Feeds Three RSS feeds providing access to newest packages (packages.xml), latest updates (updates.xml), and per-project release feeds for staying current with package changes.
• Secret Reporting API API for third parties (GitHub, deps.dev) to report accidentally exposed PyPI API tokens using ECDSA signatures, enabling automatic token revocation for affected users.

Segments2 records

Ideal customer profiles2 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Feature5 records

Partnerships

Nine partnerships are on record, tiered core and supporting.

• AWS (Amazon Web Services)coreOthersAWS provides cloud computing infrastructure sponsorship for PyPI, helping support the massive scale of package distribution (41.5 TB total) and serving millions of downloads.
• GooglecoreOthersGoogle provides download analytics sponsorship and supports PyPI infrastructure, contributing to the sustainability of Python's package ecosystem.
• DatadogcoreOthersDatadog provides monitoring services for PyPI, helping track performance and availability of the package index infrastructure.
• FastlycoreOthersFastly provides CDN services for PyPI, enabling fast global delivery of Python packages to users worldwide.
• DepotsupportingOthersDepot provides continuous integration services sponsorship for PyPI's build and release infrastructure.
• PingdomsupportingOthersPingdom provides monitoring services to track PyPI's uptime and performance status.
• SentrysupportingOthersSentry provides error logging services to help PyPI developers identify and resolve issues in the platform.
• StatusPagesupportingOthersStatusPage provides status page services for PyPI, enabling transparent status communication to users.
• Python Software FoundationcoreStrategic or Co-development PartnerPSF is the non-profit organization that owns and governs PyPI. The Packaging Workgroup within PSF handles fundraising and disbursement for PyPI, pip, packaging.python.org, setuptools, and cross-project packaging efforts.

Scale indicators6 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• Hex: The official package manager for the Elixir/Erlang ecosystem. Provides the same discover-install-publish workflow as PyPI for Elixir, operating under a small non-profit/community governance model.
• crates.io: The official Rust package registry. Mirrors PyPI's role for the Rust ecosystem: community-hosted packages, package manager integration (Cargo), and developer distribution. Comparable scale and operating model.
• Maven Central: The primary package repository for Java/JVM artifacts. Operates the same registry-plus-search-plus-distribution model as PyPI for the Java ecosystem, currently operated by Sonatype.
• npm: The official package registry for JavaScript/Node.js and the closest analogue to PyPI. Operates the same model — community-governed package hosting, search, install via package managers, supply-chain security features — at even larger scale, making it the most directly comparable package registry peer.
• NuGet: Microsoft's package manager and repository for .NET libraries. Provides the same developer-facing function for the .NET ecosystem that PyPI provides for Python — package discovery, installation, and publishing.
• CPAN: The Comprehensive Perl Archive Network, one of the oldest community-driven package repositories. Same function as PyPI for Perl — community-hosted package distribution — though older and with a different architectural approach.
• pkg.go.dev: The official Go package discovery and documentation site, backed by the Go module proxy. Comparable to PyPI in role — primary distribution and discovery layer for Go modules — though with a different proxy-based architecture.
• RubyGems: The official package hosting service for Ruby gems. Same core function as PyPI — discovery, installation, and distribution of language-specific packages — operated under a similar community/non-profit governance model.

Broad incumbents

• JFrog Artifactory: A commercial universal package management platform supporting many ecosystems including Python. Not a direct competitor to PyPI's free public index, but the dominant enterprise private-registry and binary-repository incumbent that enterprises use alongside PyPI.

Emerging players

• ConanCenter: The package registry for Conan, a C/C++ package manager. Covers an adjacent programming ecosystem with similar registry-plus-distribution mechanics but at smaller scale and with a more commercialized operating model than PyPI.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights6 records

Customer concentration

• GitHubgithub.com/pypi/warehouse
• Xx.com/pypi

Revenue estimate

Valuation estimate

Number of profiles

Funding overview

Funding rounds1 record

Investors1 record

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about PyPI