Private Packagist
Berlin-run private Composer registry from Packagist's own creators, with dependency security alerts
Quick Overview
| Company | Packagist Conductors GmbH |
|---|---|
| Category | Developer Tools |
| Headquarters | Berlin, Germany |
| EU Presence | EU (Germany) |
| Open Source | No |
| Pricing | Base plan €649/year including 3 users and 3 suborganizations, additional users/suborganizations €187/year each; self-hosted priced separately |
| Free Option | 14-day free trial, no credit card required |
| Replaces | GitHub Packages, JFrog Artifactory, self-hosted Composer mirrors |
Detailed Review
Private Packagist is the commercial registry built by the same people who created Packagist.org and Composer itself, extending the public PHP package registry with a private one for a team's own code. It mirrors packages from Packagist.org and other repositories, supports Git, Mercurial and Subversion, and adds security monitoring that alerts on vulnerable dependencies plus license review across everything a PHP project depends on — none of which any forge in this category does natively for Composer specifically.
Packagist Conductors GmbH, based in Berlin, publishes its cloud pricing in full: a Base plan at €649 per year covering the first three users and three suborganizations, with each additional user or suborganization beyond that at €187 per year, prorated when added or removed mid-period. A self-hosted option is priced separately for teams that need Private Packagist behind their own firewall rather than in the vendor's cloud, and a 14-day free trial needs no credit card upfront.
The honest scope: this is a package registry, not a code host or CI system, so it sits alongside whichever forge a PHP team already uses rather than competing with GitLab, Gitea or Codeberg. It's also PHP-specific, built around Composer's ecosystem, so teams working in other languages get nothing from it — but for a PHP shop that wants private packages with real security monitoring, it's a narrowly-targeted, well-priced fit from the people who built the standard it extends.
What Private Packagist does well
- Built by Packagist.org and Composer's own creators
- Security monitoring flags vulnerable PHP dependencies automatically
- License review across every dependency, not just direct ones
- Full published pricing, including per-user add-on costs
- 14-day free trial, no credit card required
Where Private Packagist falls short
- PHP/Composer-specific; no value for other language ecosystems
- Self-hosted pricing isn't published on the main pricing page
- Another subscription alongside whichever forge a team already runs
- Base plan's per-user add-on cost adds up for larger teams
Standout feature. A private Composer registry built by the two people who created Packagist and Composer in the first place.
Pros and Cons
Pros
- Built by Packagist.org and Composer's own creators
- Security monitoring flags vulnerable PHP dependencies automatically
- License review across every dependency, not just direct ones
- Full published pricing, including per-user add-on costs
- 14-day free trial, no credit card required
Cons
- PHP/Composer-specific; no value for other language ecosystems
- Self-hosted pricing isn't published on the main pricing page
- Another subscription alongside whichever forge a team already runs
- Base plan's per-user add-on cost adds up for larger teams
Alternatives to Private Packagist
Frequently Asked Questions
What is Private Packagist?
Private Packagist is the commercial registry built by the same people who created Packagist.org and Composer itself, extending the public PHP package registry with a private one for a team's own code. It mirrors packages from Packagist.org and other repositories, supports Git, Mercurial and Subversion, and adds security monitoring that alerts on vulnerable dependencies plus license review across everything a PHP project depends on — none of which any forge in this category does natively for Composer specifically.
Where is Private Packagist based?
Private Packagist operates from Berlin, Germany, which places it under EU (Germany).
What does Private Packagist cost?
Base plan €649/year including 3 users and 3 suborganizations, additional users/suborganizations €187/year each; self-hosted priced separately. 14-day free trial, no credit card required.
Who is Private Packagist best for?
PHP teams wanting a private Composer registry. A private Composer registry built by the two people who created Packagist and Composer in the first place.
What are the drawbacks of Private Packagist?
PHP/Composer-specific; no value for other language ecosystems. Self-hosted pricing isn't published on the main pricing page. Another subscription alongside whichever forge a team already runs. Base plan's per-user add-on cost adds up for larger teams.
Is Private Packagist a good alternative to GitHub Packages?
Private Packagist is built as a European alternative to GitHub Packages: Berlin-run private Composer registry from Packagist's own creators, with dependency security alerts. It will not be a like-for-like feature match in every respect, so check the review above for where the two genuinely differ before switching.
How does Private Packagist compare to other Developer Tools?
Private Packagist is one of several European Developer Tools we cover. It is most often compared with GitHub Packages, JFrog Artifactory, self-hosted Composer mirrors.