pip install: wheel or source, and what runs on your machine?

A wheel is a prebuilt package that pip unpacks. A source distribution has to be built first, and building uses the project's own build backend, which is code supplied by the project. If you want to avoid running build code from packages you have not vetted, ask pip to use binaries only.

The two formats

Wheels are built ahead of time, so installing is mostly copying files into place. Source distributions contain the project's source and instructions to build it. pip reads the project's metadata with a build backend and, when needed, builds a wheel locally.

Why that difference matters

Code that runs during a build runs with your user's permissions, on your machine, before you have used the package at all. For a trusted project that is routine. For an unfamiliar one, it is the same exposure as an install script in other ecosystems.

Note that a wheel can still contain code that runs when you import it. Wheels reduce build time execution, not all risk.

The option that limits it

pip documents an option that means do not use source packages. Packages with no binary distribution then fail to install.

pip install --only-binary=:all: some-package

That is a useful default for CI and for installing tools you have not used before. When something fails, you learn it only offers a source release, and you can decide whether to build it deliberately, ideally in a container.

Pair it with hash checking

pip also has a mode that requires a hash for each requirement. It switches on automatically when any entry in a requirements file carries a hash option. With hashes recorded, the file you tested is the file you install.

some-package==1.2.3 --hash=sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

The value above is a placeholder. Generate real ones with your tooling.

Practical defaults

• Binary only in CI unless a package needs a build.
• Build from source inside a throwaway container with no secrets.
• Pin versions and hashes for production.
• Review new packages before adding them.

Quick check

Sources

• pip documentation: pip install

Last reviewed: 19 October 2026.