What is PyPI (Python Package Index)?

PyPI (Python Package Index) is the official package repository for Python. When a developer runs uv add requests or pip install requests, the package is downloaded from PyPI by default. As of September 2026 it hosts about 890,000 projects, 9.6 million releases, and 21 million distribution files totaling 46 TB, and served 2.56 trillion requests in 2025.

PyPI is run by the Python Software Foundation and powered by Warehouse, an open-source application developed under the umbrella of the Python Packaging Authority (PyPA). Downloads are served through Fastly’s CDN.

What PyPI hosts

PyPI stores two types of distribution packages:

• Wheels (.whl files) are pre-built distributions that install quickly. A single project can upload multiple wheels for different platforms and Python versions.
• Source distributions (.tar.gz files) contain raw source code. Installers build the package locally when no matching wheel is available.

Each file carries Core Metadata: name, version, description, dependencies, supported Python versions, and project URLs. Build backends generate it from the [project] table of pyproject.toml, and PyPI reads it at upload time to populate the project page and its JSON API.

How packages get installed from PyPI

Package installers like uv and pip communicate with PyPI through the Simple Repository API defined in PEP 503. The installer queries the index for available versions, resolves dependencies, downloads the best matching distribution, and installs it into the active virtual environment.

uv add requests        # adds to project and installs from PyPI
uv pip install flask   # pip-compatible interface to PyPI

How packages get published to PyPI

Package authors build distributions with a build frontend and upload them to PyPI. With uv:

uv build       # creates wheel and sdist in dist/
uv publish     # uploads to PyPI

Authentication uses either an API token (generated at pypi.org and sent with the username __token__) or trusted publishing, which lets GitHub Actions and other CI providers upload packages without storing long-lived credentials. More than 50,000 projects publish this way, covering over 20% of uploads in 2025. See How to publish to PyPI with trusted publishing for a step-by-step guide.

Every account that uploads must have two-factor authentication enabled. Companies and community projects can group maintainers and packages under an organization account; 7,742 organizations managed 9,059 projects at the end of 2025.

TestPyPI

TestPyPI is a separate instance of PyPI intended for testing package uploads without affecting the real index. It uses the same API and interface, so switching between them requires only a URL change. See Publishing your first Python package to PyPI for a tutorial that uses TestPyPI.

Private package indexes

PEP 503 defines the Simple Repository API that PyPI implements. Any server that speaks the same protocol works as a drop-in replacement. Organizations use this to host internal packages on services like AWS CodeArtifact, Google Artifact Registry, and JFrog Artifactory. See How to use private package indexes with uv for configuration details.

How PyPI handles bad packages

PyPI is an open index: anyone with an account can publish, so supply-chain attacks through typosquats, stolen tokens, and hijacked maintainer accounts are a standing problem. PyPI’s response works in layers.

• Anyone can report a project as malware from its project page. PyPI processed more than 2,000 reports in 2025 and handled 66% within 4 hours.
• Administrators can quarantine a project or release: it disappears from the Simple index, so installers cannot fetch it, and its owners cannot modify it until the review finishes.
• Malware, spam, name squatting, and obfuscated code are invalid projects under PEP 541 (Package Index Name Retention), and PyPI removes them. The same policy governs transferring an abandoned name to a new maintainer.
• Releases reject new files after 14 days, so a stolen token cannot quietly poison an old, stable release.
• Email addresses whose domain expires are un-verified, and PyPI refuses password resets to unverified addresses, which blocks account takeover through a re-registered domain.

Supply-chain security for consumers

PyPI supports digital attestations and trusted publishing to help users verify that packages were built from the claimed source repository. uv can also verify download hashes against what PyPI reports. See How to protect against Python supply chain attacks with uv for a broader overview of defense measures.