pylock.toml is the standard Python lock file format defined by PEP 751. It records the exact packages to install, where each came from, and file hashes, so an installer can reproduce an environment without resolving dependencies again. Before it, each tool used its own lock format.
Why it exists
PEP 751 notes that several tools already produce lock files in their own formats, and that pip's requirements.txt is a common stand-in but is not a formal standard and is not secure by default. The goal was one format that tools and people can share. The PEP is marked final, and the current specification is kept on the Python Packaging Authority specs site.
What the file records
| Field | What it holds |
|---|---|
| Environments | Supported environments, minimum Python, extras and groups covered |
| Packages | Normalized name and, where stable, version, plus an optional marker |
| Sources | Whether from a repository, directory, archive, source distribution or wheels, with URL or path |
| Hashes | At least one hash per file, with a secure algorithm such as sha256 recommended |
| Other details | File sizes, upload times, index used, attestation identities where available |
| Dependencies | Direct dependencies of each package, kept for auditing only |
The dependency list is for auditors. The PEP says installers must not use it during installation.
What it is designed to do
- Reproducible installs: an installer works out what to install without resolving at install time.
- Auditability: it is human readable, so an unwanted package is easy to spot in a review.
- Security by default: it requires hashes and records where files came from.
- Interoperability: tools in any language can read it.
requirements.txt versus pylock.toml
A requirements file is a list of pip arguments, often with an index setting baked in, and hashes are optional. A pylock file has a defined structure, and hashes are part of it. For a team, that means a review of a lock change can rely on a known shape, and a scanner can read it without guessing.
What to do today
- Check whether your installer and your scanner support the format before you switch.
- Keep your current lock file in place until both do.
- When you adopt it, review the first generated file once, line by line, for sources you do not recognise.
Try it yourself
Click through it at your own pace, or open it full screen. A recorded, exact package list is what makes ongoing matching against new advisories possible.
Quick check
Is pylock.toml the same as poetry.lock?
No. It is a shared standard. Tools may export to it, but their own lock files are separate formats.
Does it include hashes?
Yes. At least one hash per file is required in the format.
Safeguard's SBOM and dependency scanning works from pinned manifests, with a free scan available.
Sources
Last reviewed: 19 October 2026.
