pip or python -m pip: which pip are you actually running?

Use python -m pip, not bare pip, when you want to be sure which Python receives the install. The pip documentation says python -m pip runs pip for the interpreter you named, so a path like /usr/bin/python3.7 -m pip installs for that exact interpreter. A bare pip command may point at another one.

The problem in one example

Many laptops have more than one Python: one from the operating system, one from a package manager, one inside a project environment. Each can ship its own pip command. When you type pip, the shell picks the first match on your PATH. That match might not belong to the Python you are about to use.

The result is quiet and confusing. You install a library, import fails, and you install again with sudo. Or worse, a package lands in a different environment than you expected, including a global one.

What the pip docs say

The pip user guide describes the command line as python -m pip followed by arguments on Unix and macOS, and py -m pip on Windows. It states that python -m pip executes pip using the Python interpreter you specified as python. On Windows, the py launcher uses the latest Python interpreter you have installed.

Three checks before you install

which python
python -m pip --version
pip --version

Compare the paths in the last two outputs. The version line for pip includes the location of the pip package and the Python version it belongs to. If those differ, bare pip and python -m pip are not talking to the same place.

A fourth check is inside a virtual environment. After activating one, the python path should sit inside the environment folder. If it does not, you are not isolated, and installs go somewhere wider.

Why this is a security habit

Installing into the wrong environment is not just untidy. Packages run code at install time in some cases, and whatever you install gains the privileges of the account running it. Our post on whether pip install runs code from packages explains when. Knowing exactly which interpreter and environment you are writing into limits what a bad package can affect and makes cleanup possible.

It also helps with records. A requirements file generated from the wrong interpreter describes the wrong software.

A simple team rule

1. Write python -m pip in every README and setup script.
2. Create a project environment first, then install into it. See pip install user flag versus a virtual environment for the trade-offs.
3. Print the interpreter path at the top of CI logs so you can tell later where installs went.
4. Avoid sudo with pip. If an install demands it, you are probably targeting the system Python.

Related checks

If pip refuses with an externally managed environment message, that is a deliberate guard from your operating system, explained in why pip says externally managed environment.

Quick check

Sources

• pip user guide

Last reviewed: 19 October 2026.