Packagist
Packagist is the default package repository for Composer, the dependency manager used by PHP developers.
What Packagist is
Packagist is the default package repository for Composer, the dependency manager used by PHP developers. It collects public PHP packages that anyone can install with Composer and tells Composer where to retrieve their code. To publish a package, a user submits its public repository URL; Packagist checks that repository periodically. New releases are pulled from repository tags, while branches are shown as development versions. Developers can set up automatic updates through hooks or webhooks from GitHub, Bitbucket, GitLab, and Gitea. Its API supports package search, listings, package details, download statistics, and other operations. Many endpoints work without authentication; others accept bearer tokens or a username and API token. Packagist.org is free to publish open-source PHP packages. The company says stable versions cannot be silently replaced with different code and that package metadata is hosted on Bunny.net’s global CDN. Packagist.org is limited to public packages; the maker directs users with private-code needs to Private Packagist. Packagist Conductors GmbH is registered in Berlin and says it has operated the service since its creation in 2012.
Good
- Free to publish open-source PHP packages.
- Collects public PHP packages for Composer.
- Supports update hooks from four listed services.
- API includes search and download statistics.
- Stable versions cannot be silently replaced, the maker says.
Watch out
- Packagist.org does not support private packages.
- Community-run mirrors may be outdated, broken, or insecure.
- Sponsorship plans require annual commitments.
Who it suits
Packagist suits PHP developers using Composer to manage project or library dependencies. It is intended for public packages, not sharing private code.
Verdict
Packagist is a public-package directory and update source for PHP projects managed with Composer. Developers who need to share private code are directed to Private Packagist.
Plans and prices
From Packagist's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Packagist.org | Free | Free to publish open source PHP packages |
| Bronze sponsorship | €2,500 a month | Sponsor page logos · Social media welcome post · Annual thank-you blog post · Composer GitHub README logo · 10% Private Packagist discount · Annual commitment |
| Silver sponsorship | €5,000 a month | Bronze benefits · Shared Slack channel · Priority issue/bug response on GitHub · 15% Private Packagist discount · Annual commitment |
| Gold sponsorship | €8,000 a month | Silver benefits · Packagist.org footer logo · 20% Private Packagist discount · Annual commitment |
The facts
Each one read from Packagist's own pages, with the date it was checked.
What it does
- API authentication
- Many API endpoints are anonymous, while authenticated endpoints accept bearer tokens or username and API token parameters.checked 4 Oct 2026
- Mirror security
- Packagist warns that community-run mirrors are unaffiliated and may be outdated, broken, or insecure.checked 4 Oct 2026
- Package publishing
- Users publish a package by submitting its public repository URL, after which Packagist periodically crawls it.checked 4 Oct 2026
- Private code limit
- Packagist.org is for public packages; the maker directs users who need to share private code to Private Packagist.checked 4 Oct 2026
- Public packages
- Packagist aggregates public PHP packages that anyone can install with Composer.checked 4 Oct 2026
- Purpose
- Packagist is the default Composer package repository, helping users find packages and telling Composer where to get their code.checked 4 Oct 2026
- Search API
- The API supports package search, package listings, package data and download statistics, among other operations.checked 4 Oct 2026
- Security
- The site says Packagist.org package metadata is hosted on Bunny.net's global CDN.checked 4 Oct 2026
- Stable version integrity
- The maker states that stable Packagist.org versions are immutable and cannot be silently replaced with different code.checked 4 Oct 2026
- Support
- Commercial support and consulting for PHP dependency management with Packagist and Composer are available through Private Packagist subscription plans.checked 4 Oct 2026
- Update integrations
- Automatic package updates are supported through GitHub, Bitbucket, GitLab, and Gitea hooks or webhooks.checked 4 Oct 2026
- Version updates
- New package versions are fetched from repository tags, and branches appear as dev versions.checked 4 Oct 2026
- Who it serves
- Packagist serves PHP developers who use Composer to manage project or library dependencies.checked 4 Oct 2026
The company
- Founded
- 2012checked 28 Sep 2026
- Headquarters
- Berlin, Germanychecked 28 Sep 2026
- Maker
- Packagist Conductors GmbH is registered in Berlin, Germany, and the company says it has operated Packagist.org since its creation in 2012.checked 4 Oct 2026
Alternatives to Packagist
- 1
PyPI
Free planOpen sourceWebAPILinuxmacOS8.1Free plan - 2
Bioconductor
Free planOpen sourceWebLinuxmacOSSelf-hosted7.6Free plan - 3
npm
Free planLinuxmacOSWindows7.5From $7 a month - 4
Inedo ProGet
Free planWebAPILinuxSelf-hosted7.4From $2,395 a year - 5
GNU ELPA
Free planOpen sourceWebSelf-hosted7.0Free plan - 6
LuaRocks
Free planAPILinuxmacOSSelf-hosted6.9Free plan