375 stars · MPL-2.0 · 2.5.0 on PyPI (2026-08-29) · Track this in Rising ↗
A way to reach a returning visitor who never gave you an email address.
Radar check
What we found when we opened it. Every bar is one fact, with its date.
Last code pushed 1 Sep 2026, 56 days before this check.
Latest release 2.3.0 on 13 Jul 2026.
Public since May 2016, a little over 10 years.
380 stars and 61 forks.
14 commits and 0 new issues in the last 90 days.
36 contributors. 12 pull requests merged in 90 days.
No security policy file says how to report a problem. No published security advisories.
How the bars are scored
- Alive. Days since the last code push: a week or less 100, a month 90, three months 70, six months 50, a year 30, eighteen months 15, older 0.
- Releases. Age of the latest GitHub release, on a similar scale; no bar when the project publishes no releases.
- Maturity. Age of the project: eight years 100, five 90, three 70, two 55, one 40, six months 25, younger 10.
- Adoption. Stars on a log scale: 100,000 stars is 100, 10,000 is 80, 1,000 is 60, 100 is 40.
- Activity. Commits in the last 90 days: 300 or more 100, 100 85, 30 65, 10 45, any 25.
- Community. People who have contributed: 100 or more 100, 30 80, 10 60, 5 40, 2 25, one 10.
- Security. A published security policy 80, none 40; published advisories are listed, not scored.
Checked by Repo Radar on 27 Oct 2026 from the repository on GitHub. Covered in Edition 10.
▶Repo detailsthe review · specs · pros & cons · install
What it does
The main call is webpush(). You give it the subscription record a browser produced, the message, and a signing key. It encrypts the message, adds the authentication headers the push service expects, and posts it to the address in the subscription. Those headers follow the VAPID scheme, which is how a push service knows which site a message came from. The library fills in sensible defaults: if the audience claim is missing it is taken from the subscription address, and if the expiry is missing or already past it is set to twelve hours ahead. Windows push needs an extra header, which the README documents and warns is non-standard. What it does not do is cover the browser side. The permission prompt, the service worker and the display of the notification are all code you write yourself. One content encoding, aesgcm, is marked deprecated, and the README says some browsers can no longer decrypt it.
Why it matters
Who it suits. Anyone running a site whose readers come back for new material, who would like a way to tell them without asking for an email address first. A push subscription costs the reader one click and no personal details. It also avoids the whole business of sending domains and mail authentication, because nothing is being emailed. Skip it if the audience is mostly on iPhones: Apple only delivers web push to sites the reader has added to the home screen.
Verdict. The standard Python implementation, and genuinely small: 378 stars and one maintainer, which the package page states plainly while also marking it a critical project. That combination is the thing to weigh. Read the source, pin the version, and keep a second way to reach people. Also note one inconsistency: the README still points at the project's old address while the repository now lives under web-push-libs. Version 2.5.0 was published on 29 August 2026 and code landed on 1 September, so it is maintained rather than dormant. The sister project web-push-libs/web-push does the same job for Node.js at 3,532 stars.
Summary (Key Points)from the README
Key features
- Standard encryption: Encodes payloads with aes128gcm (RFC 8188) by default, with the deprecated aesgcm form available as an option.
- One-call sending: The `webpush()` function encodes the data, adds VAPID auth headers when required, and sends to the subscription's push server.
- Reusable sender: A `WebPusher` object can be created once from subscription info and reused for repeated sends.
- Flexible send options: `send()` accepts custom headers, a TTL in seconds, a reg_id, a request timeout, and a curl mode that prints a command instead of posting.
- Debug output: In curl mode, the encrypted content is written to a local file named encrpypted.data for debugging.
- VAPID defaults: If `aud` is missing, it is filled from the endpoint. If `exp` is missing or in the past, it is set to 12 hours from now. The caller's dict is mutated.
- Key input formats: The VAPID private key can be a path to a PEM file or a base64-encoded DER string.
- Stand-alone command: A `pywebpush` command in the ./bin directory reads a data file and a subscription JSON file, so you can send without writing code.
- Windows support: The README documents the X-WNS-Type header that Microsoft requires as of 2024-Apr-19, with an example that sets TTL to 10 minutes.
Important
- Single maintainer: PyPI has designated the project a Critical Project, and one person maintains it. The author still accepts PRs and issues but gives no response commitment.
- Non-standard Windows headers: The extra headers for Microsoft may be rejected by other push services, so use them only for Microsoft destinations.
- GCM is sunset: Google has ended GCM, and providers should use Firebase Cloud Messaging instead.
- No direct FCM sending: The library does not send directly to FCM. The insecure gcm_key proxy was disabled in June 2024. Chrome users are not affected.
- Deprecated aesgcm: Not all user agents can decrypt aesgcm, so it should be avoided unless you need it.
- Empty data raises an error: Calling `encode()` with empty or missing data raises a NoData exception, so skip the call when there is no payload.
Written by an AI model from the project’s README; not part of the review, and it can be wrong.
- Pure Python, MPL-2.0, no third-party service, and no cost per notification.
- Sensible defaults for the signing claims, so the common case is a few lines.
- No email address means no sending domain and no mail authentication to maintain.
- 378 stars and a single maintainer, stated on the package page itself.
- Apple only delivers web push to sites installed to the home screen, which removes part of any audience.
- A badly timed permission prompt loses the reader immediately, and this makes it easy to ask too early.
python3 -m venv venv source venv/bin/activate pip install pywebpush
