urllib3

urllib3 is the HTTP library that underpins a huge share of the Python ecosystem — it’s the transport layer inside Requests, pip, and countless other tools. It fills the gaps left by Python’s standard library HTTP support: thread-safe connection pooling, client-side TLS/SSL verification, automatic retries with configurable backoff, redirect handling, and multipart file uploads.

Maintained continuously since 2008 with a strong security track record (SLSA level 3, OpenSSF Scorecard, CII Best Practices), urllib3 is built for production use at scale. It exposes both a low-level HTTPConnectionPool/PoolManager API for fine-grained control and a simple urllib3.request() helper for quick one-off calls, supporting HTTP/1.1 and experimental HTTP/2, gzip/deflate/brotli/zstd encoding, and SOCKS proxying.

What You Get

• Thread-safe connection pooling via PoolManager and HTTPConnectionPool that reuses TCP connections across requests for lower latency
• Client-side TLS/SSL certificate verification enabled by default, with support for custom CA bundles and client certificates
• A configurable Retry class for automatic retries on connection errors, read timeouts, and specific HTTP status codes, with exponential backoff
• Multipart file upload and form-encoding helpers via encode_multipart_formdata and fields.py
• Proxy support for both HTTP and SOCKS proxies via ProxyManager and the socks extra
• Built-in support for gzip, deflate, brotli, and zstd response decoding, plus experimental HTTP/2

Common Use Cases

• Building an HTTP client library or SDK - projects like Requests wrap urllib3’s connection pooling and retry logic rather than reimplementing it
• High-throughput API clients - services that make many outbound HTTP calls reuse pooled connections to avoid TCP/TLS handshake overhead per request
• Package managers and CLI tools - pip and similar tools use urllib3 directly for reliable, retryable downloads over HTTP(S)
• Uploading files or form data - multipart encoding helpers make it straightforward to POST files without pulling in a heavier client
• Working behind corporate proxies - ProxyManager and SOCKS support handle HTTP(S) traffic through HTTP or SOCKS4/5 proxies

Under The Hood

Architecture urllib3 is organized as a layered connection-management stack: connection.py wraps a single socket-level HTTP(S) connection, connectionpool.py’s HTTPConnectionPool/HTTPSConnectionPool manage a thread-safe queue of reusable connections to one host, and poolmanager.py’s PoolManager sits on top routing requests to the correct per-host pool by parsing the target URL (with ProxyManager as a PoolManager subclass adding proxy-aware routing). Shared request-building logic lives in _request_methods.py’s RequestMethods base class, and util/retry.py’s Retry object is threaded through every layer, re-evaluated and reconstructed on each attempt so retry state stays immutable and safely shareable. This separation means the core abstraction that would break the most if changed is the pool key normalization in poolmanager.py, since it determines which requests can share a connection.

Tech Stack urllib3 is pure Python (3.10+) with zero required runtime dependencies, using the standard library’s ssl and socket modules directly rather than a C extension. Optional extras pull in brotli/brotlicffi for Brotli decoding, backports.zstd for Zstandard, PySocks for SOCKS proxying, and h2 for experimental HTTP/2 support via the http2/ submodule. The build uses hatchling with hatch-vcs for version management, and the project is fully managed with uv (uv.lock present) for dependency locking across its extensive dev/test dependency groups.

Code Quality The project reports 100% test coverage (badge-verified) with a large test/ suite covering collections, connection pooling, retries, SSL, proxies, and a with_dummyserver/ integration layer that spins up real HTTP servers for end-to-end checks. Tests run against pytest with anyio/trio for async server scenarios and hypercorn/quart as test HTTP/2 servers. The codebase is fully typed with py.typed marker and enforced mypy configuration, uses from __future__ import annotations throughout, and ships CI-verified builds (GitHub Actions badge in the README) plus supply-chain attestations (SLSA level 3, OpenSSF Scorecard).

What Makes It Unique Rather than being a convenience wrapper, urllib3 solves the specific hard problems the Python standard library leaves unsolved: safe connection reuse under concurrent access, correct TLS verification by default (a deliberate v2 design choice), and a retry model expressive enough for production services to tune per-error-type backoff. Its role as the transport layer beneath Requests and pip — rather than a competing high-level client — is itself the differentiator: it optimizes for correctness and stability at the layer just above raw sockets, which is why higher-level HTTP libraries build on it instead of around it.