How to Install Composer on Debian (13, 12, 11)

PHP projects get messy fast when each machine pulls a different dependency set. You can install Composer on Debian from the default repositories or from the upstream installer, then use it on Debian 13, 12, and 11 to lock package versions, fetch libraries from Packagist, and keep deployments predictable.

Composer is the dependency manager behind many PHP frameworks and libraries, but it is just as useful for small scripts and internal tools. Debian 13, 12, and 11 all ship Composer in the default package sources, while the upstream installer gives you the newest Composer release sooner.

Install Composer on Debian

Two installation paths fit most Debian systems. APT keeps Composer tied to Debian’s maintenance cycle, while the upstream installer tracks the newest release from getcomposer.org.

Method	Channel	Version	Updates	Best For
APT package	Debian Repositories	Debian 13: 2.8.x; Debian 12: 2.5.x; Debian 11: 2.0.x	System-managed through APT	Most users who want the lowest-maintenance setup
Official installer	Composer Upstream	Latest upstream 2.9.x	Manual with composer self-update	Projects that need the newest Composer release

Use one installation method at a time. A manual install in /usr/local/bin/composer overrides the Debian package in /usr/bin/composer, which makes updates and removals harder to track if both are present.

Update Debian and install Composer prerequisites

Desktop installs may already include some of these packages, but server and minimal images usually do not. php-curl is the PHP extension Composer uses for faster downloads, while curl is the separate command-line downloader used by the upstream installer.

sudo apt update

This guide uses sudo for commands that need root privileges. If your account does not have sudo access yet, switch to root or follow the guide on how to add a user to sudoers on Debian.

sudo apt install php-cli php-curl ca-certificates unzip curl git -y

The upstream method uses the curl command in Linux to download the installer and signature. If your project needs a newer runtime than Debian ships by default, follow the guide to install PHP on Debian before you pick a Composer method.

Install Composer from Debian default repositories

The Debian package is the low-maintenance option because APT keeps it aligned with the rest of your system packages.

sudo apt install composer -y

Check the installed version once APT finishes.

composer --version

Composer version 2.8.8 2025-04-04 16:56:46
PHP version 8.4.16 (/usr/bin/php8.4)
Run the "diagnose" command to get more detailed diagnostics output.

Current default APT versions differ by Debian release: Debian 13 installs Composer 2.8.8, Debian 12 installs 2.5.5, and Debian 11 installs 2.0.9.

composer self-update is not available in the Debian package on Debian 13, 12, or 11. Use the APT update section later in this guide if you install Composer this way.

Install Composer with the official installer

The upstream installer is the better fit when your project needs a newer Composer release than Debian currently ships. Remove the Debian package first if command -v composer already points to /usr/bin/composer and you want one clear update path.

curl -sS https://getcomposer.org/installer -o composer-setup.php

Next, compare the download with the current SHA-384 signature published by Composer.

HASH="$(curl -sS https://composer.github.io/installer.sig)"
php -r "if (hash_file('sha384', 'composer-setup.php') === '$HASH') { echo 'Installer verified' . PHP_EOL; } else { echo 'Installer corrupt' . PHP_EOL; unlink('composer-setup.php'); exit(1); }"

Installer verified

The first command stores Composer’s current published signature in the HASH shell variable, then the PHP one-liner compares that value against the installer you downloaded.

Install Composer globally so the composer command works from anywhere on the system.

sudo php composer-setup.php --install-dir=/usr/local/bin --filename=composer

All settings correct for using Composer
Downloading...

Composer (version 2.9.5) successfully installed to: /usr/local/bin/composer
Use it: php /usr/local/bin/composer

Remove the installer script and confirm the global binary is active in your shell.

rm composer-setup.php
composer --version

Composer version 2.9.5 2026-01-29 11:40:53
PHP version 8.4.16 (/usr/bin/php8.4)
Run the "diagnose" command to get more detailed diagnostics output.

A global install in /usr/local/bin/composer is owned by root, so later updates use sudo composer self-update. If you install Composer somewhere inside your home directory instead, drop sudo for updates.

Run Your First Composer Commands on Debian

Once Composer is installed, a small test project confirms that dependency resolution, downloads, and autoload generation all work on your system. Composer pulls public packages from Packagist, so this example gives you a quick end-to-end check.

Create a test Composer project on Debian

This sample creates a small project that installs Monolog, which works on Debian 13, 12, and 11 with the package versions tested for this article.

Run Composer project commands as your regular user, not as root. On Debian, composer require warns about root usage, disables plugins by default in non-interactive sessions, and can leave your project files owned by root.

mkdir composer-demo
cd composer-demo
composer init --name=linuxcapable/demo --require=monolog/monolog:^2.10 --no-interaction
composer install --no-interaction

The --no-interaction flag writes a minimal composer.json without prompts, which makes the example easier to reuse in SSH sessions and scripts.

List the installed package to confirm Composer resolved and downloaded the dependency.

composer show monolog/monolog

name     : monolog/monolog
descrip. : Sends your logs to files, sockets, inboxes, databases and various web services
keywords : log, logging, psr-3
versions : * 2.11.0

Inside an existing project, use composer require vendor/package to add a dependency and composer update vendor/package to refresh one package without touching the rest of the lock file.

Install dependencies from an existing Composer project on Debian

When a project already includes composer.json and composer.lock, use composer install to recreate the exact dependency set recorded in the lock file.

composer install --no-interaction

Installing dependencies from lock file (including require-dev)
Verifying lock file contents can be installed on current platform.
Package operations: 2 installs, 0 updates, 0 removals
Generating autoload files

Keep composer.json and composer.lock in version control so everyone installs the same package versions. The generated vendor/ directory is rebuilt locally with composer install, so it usually does not belong in your repository.

Update or Remove Composer on Debian

The correct maintenance command depends on how you installed Composer, so keep the APT and upstream workflows separate.

Update APT-installed Composer on Debian

The Debian package updates through APT, not through Composer’s own self-update command.

sudo apt update
sudo apt install --only-upgrade composer -y

Check the installed version after the package upgrade finishes.

composer --version

Composer version 2.8.8 2025-04-04 16:56:46
PHP version 8.4.16 (/usr/bin/php8.4)
Run the "diagnose" command to get more detailed diagnostics output.

Update a manually installed Composer on Debian

A global upstream install in /usr/local/bin/composer needs sudo for updates because root owns the binary.

sudo composer self-update

Verify the updated binary once the self-update command completes.

composer --version

Composer version 2.9.5 2026-01-29 11:40:53
PHP version 8.4.16 (/usr/bin/php8.4)
Run the "diagnose" command to get more detailed diagnostics output.

Remove APT-installed Composer on Debian

Use APT removal only when Composer came from Debian’s default package sources.

sudo apt update
sudo apt remove composer -y

Confirm the package is gone from the installed state.

apt-cache policy composer

composer:
  Installed: (none)
  Candidate: 2.x.x
  Version table:
     2.x.x 500

The version number is a placeholder. Your output will show the Composer package version available for your Debian release.

If command -v composer still returns a path after this removal, you still have a manual install such as /usr/local/bin/composer on the system.

Remove a manually installed Composer on Debian

Delete the global binary and, if you no longer need Composer settings or caches for your account, remove the user data directories Composer created during normal use.

sudo rm -f /usr/local/bin/composer
rm -rf ~/.config/composer ~/.cache/composer ~/.local/share/composer

If you installed Composer to a different location with --install-dir, change the first path to match your custom binary.

Check that the command is no longer present in your shell.

command -v composer || echo "composer not found"

composer not found

Fix Common Composer Problems on Debian

Most Composer failures on Debian come from PATH issues, Debian’s package-specific update behavior, or missing PHP extensions.

Fix "composer: command not found" on Debian

Start by checking whether your shell can find the Composer binary.

command -v composer

/usr/bin/composer

APT installs usually print /usr/bin/composer, while manual installs usually print /usr/local/bin/composer. If nothing prints, reinstall Composer with the method you chose and open a new shell if you just changed your PATH.

Fix the "self-update" error on Debian

The Debian package disables Composer’s self-update command, so this error is expected when you installed Composer through APT.

composer self-update

Command "self-update" is not defined.

Use sudo apt install --only-upgrade composer when Composer came from Debian’s repositories. If you want upstream self-updates instead, remove the Debian package and reinstall Composer with the official installer.

Fix missing PHP extensions for Composer on Debian

Composer can warn about slow downloads or refuse specific packages when required PHP extensions are missing. Installing the common extensions below fixes the most common dependency and performance issues.

sudo apt install php-curl php-xml php-mbstring -y
php -m | grep -E 'curl|libxml|mbstring|xml'

curl
libxml
mbstring
xml
xmlreader
xmlwriter

If your application also needs database drivers or a newer PHP branch, continue with the guide to install PHP on Debian and add the specific extension packages your project requires.

Composer on Debian FAQ

Conclusion

Composer is ready on Debian to keep your PHP dependencies consistent across development machines and production hosts with the same composer.json and composer.lock workflow. If this system is also serving PHP applications, the usual next step is to install PHP on Debian, install Apache on Debian, or install Nginx on Debian.