Paramiko 5.1.0 gives you SSHv2 client and server in pure Python, and recommends Fabric instead

The README routes ordinary client work to Fabric and keeps Paramiko for primitives

Read the opening paragraph and the project tells you when not to reach for it. Paramiko provides the foundation for Fabric, and Fabric is what the maintainers recommend for common client use cases such as running remote shell commands or transferring files. Direct use of Paramiko is described as intended only for users who need advanced or low-level primitives, or who want to run an in-Python sshd. The consequence is a scope decision before you install anything: if your task is to execute a command on a host and read the output, you are picking the layer the project considers one step too low. What you give up by starting at Paramiko instead is Fabric's command layer, and what you take on is writing the pieces around the protocol yourself.

Pure Python still pulls in cryptography, which is built from C and Rust

The dependency list is four entries, and one of them does the actual cryptography:

dependencies = [
  "bcrypt>=3.2",
  "cryptography>=3.3",
  "invoke>=2.0",
  "pynacl>=1.5",
]

A footnote in the README explains why that matters. Paramiko relies on the cryptography package for crypto functionality, and cryptography makes use of C and Rust extensions while offering many precompiled options. The word pure-Python therefore describes the protocol implementation, not your install footprint. On a platform with no matching precompiled option, the install compiles code instead of downloading a wheel, so a library that looks extension-free by name can need a working toolchain on the machine you deploy to. That is the single dependency detail worth checking first.

OpenSSH is the reference implementation, and the README admits the gaps

Paramiko measures itself against OpenSSH rather than against a specification document of its own. The README calls OpenSSH the primary reference implementation, says that when in doubt the maintainers consult how OpenSSH does things unless there are good reasons not to, and points readers at the OpenSSH specification page as a resource the project will not replicate. It then concedes that there are always some gaps and that the project reconciles them when it can. That is an unusually plain statement for a protocol library, and it tells you how to read a discrepancy. When Paramiko and an OpenSSH implementation differ on an edge case, the project considers itself the side moving toward OpenSSH, so behaviour you see here is evidence about Paramiko rather than a definition of SSHv2.

Version 5.0.0 lives in pyproject.toml, and the release notes live on a website

There is no GitHub releases page for this repository, so the version you install comes from package metadata rather than from a release entry:

[project]
name = "paramiko"
requires-python = ">=3.9"
version = "5.0.0"
description = "SSH2 protocol library"

The project's own URLs point the changelog at https://www.paramiko.org/changelog.html and the API reference at the versioned docs on https://docs.paramiko.org, and installation details sit at https://www.paramiko.org/installing.html. The README gives no pip command of its own, so the install step is a website visit rather than a line you can copy from here. The last push to main was on 2026-10-18.

LGPL-2.1 is declared in pyproject and named to a single LICENSE file

pyproject.toml carries license = "LGPL-2.1" alongside license-files = ["LICENSE"], and the repository root holds that LICENSE file. The package metadata also names a single author, Jeff Forcier, whose address matches the personal site where the README says the maintainer keeps a roadmap. For a library that most teams reach for indirectly, through a tool built on top of it, the license identifier is the part to carry into your own review process, since it travels with anything linked against Paramiko. Nothing in the README discusses relicensing, exceptions, or how the terms apply to a particular distribution model, so a question about your specific use has to go to whoever owns that question where you work rather than to this document.

Dockerfile.i386 and a .bzrignore sit beside ruff, flake8 and black

The repository root is a record of how the project is built rather than of what it exposes. Alongside the paramiko package, tests/, sites/ and images/ sit Dockerfile.i386, a 32-bit build definition, tasks.py for invoke-based tasks, pytest.ini, .coveragerc, .codespellrc and .git-blame-ignore-revs. Two codecov configuration files also sit at the top level, .codecov.yml and codecov.yml, and two linters are configured at once, .flake8 and a ruff section, alongside a pinned black. Two things follow for anyone tracking the project. The i386 image means 32-bit targets are still a build concern even though the classifiers say Operating System :: OS Independent, and the .bzrignore file dates the layout to a version control era before git.

Client and server ship together, and server hardening is undocumented

Paramiko provides both client and server functionality, and the README names running an in-Python sshd as one of the two reasons to use it directly. That makes it a building block for an SSH server that lives inside a Python process, which is a different job from being an SSH client. It also puts a protocol server in your process, and the README says nothing about hardening that server: no guidance on host key policy, authentication backoff, ciphers to disable, or what to do with a key that a client presents twice. The repository does contain a SECURITY.md, and the README does not mention it, so the reporting channel is a file you have to open rather than an address the front page gives you. Plan that mode's security review from OpenSSH's own documentation and Paramiko's versioned docs, not from the README.

Editorial conclusion

Adopt Paramiko when you are building something on top of SSH rather than calling it once: a library that needs SSHv2 primitives of its own, a test harness, or an SSH server that has to live inside a Python process, since the README names an in-Python sshd as a supported direct use. Do not adopt it to run remote commands or move files, because that is the case the maintainers hand to Fabric, and do not adopt it if LGPL-2.1 terms or the absence of GitHub release notes do not fit your process. Before installing, read https://www.paramiko.org/installing.html for the cryptography dependency, because a library described as pure-Python still pulls in a wheel with C and Rust extensions, and check whether a precompiled option exists for the platform you deploy to.

Frequently asked questions

Official sources

1. Issues
2. License: LGPL-2.1
3. paramiko/paramiko on GitHub
4. Project website
5. README