Install the poetry export plugin, run poetry export with the requirements.txt format and an output file, and install the result with pip using the no deps option. The file contains the versions Poetry already resolved, with hashes unless you turn them off. Check which dependency groups the export includes.
When you need this
Sometimes a team is moving off Poetry, or a deployment step, a base image build or a scanner expects a plain requirements file. An export gives that file without re-resolving anything, so the versions come straight from poetry.lock. It is also a useful bridge while two tools coexist during a migration.
Steps
- Add the plugin. On Poetry 2.0 and newer the plugin README says the easiest way is to declare it as a required plugin in pyproject.toml. Otherwise use the self add command.
- Export to a file.
- Install from that file with the no deps option.
poetry self add poetry-plugin-export
poetry export -f requirements.txt --output requirements.txt
pip install --no-deps -r requirements.txt
Why no deps matters
The plugin documentation marks this as important: when installing an exported file with pip, pass no deps, because Poetry has already resolved every direct and transitive requirement and there is no need to resolve again. The README adds that pip may even fail to resolve, especially with git dependencies, which are exported with their resolved hashes. Letting pip re-resolve is also a security concern: it could choose a version that Poetry did not.
Groups, extras and hashes
| Option | What it controls |
|---|---|
| with, only | Which dependency groups are included. By default only main dependencies |
| extras, all extras | Optional dependency sets |
| all groups | Every group in one file |
| without hashes | Drops hashes. Leave it off for supply chain checks |
| with credentials | Includes credentials for extra indices. Avoid committing the output |
By default only the main group is exported, so a file meant for CI test runs needs a group flag. Several older flags such as dev and default are marked deprecated in the README, so prefer the group options.
The credentials option deserves a warning. Writing registry credentials into a requirements file that you then commit would be a secret leak. Keep that file out of version control or leave the option off.
A note on private indexes
If your project uses extra package sources, check how the exported file refers to them before installing on a build machine. A requirements file that mixes a private index and the public one has the same confusion risk as any multi index pip setup, so keep the index configuration explicit and read why pip extra index url is unsafe for private packages before you rely on it.
Verify the export
Compare the exported versions with poetry.lock, or with a listing from the old environment, using the diff method in how to verify resolved versions after switching package managers. Then install with hash checking, as covered in how pip hash checking mode works.
Safeguard's dependency scanning can run on the exported file as well as the lock, and the free scan at gold.safeguard.sh/scan is a quick check.
Quick check
Does the export include dev dependencies by default?
No. By default only the main group is exported. Use the group options to include more.
Why keep hashes in the exported file?
They let pip verify each downloaded file against what Poetry resolved, so a tampered or substituted file is rejected.
Sources
Last reviewed: 19 October 2026.
